Binance says hackers used fake job interviews, malicious code in $6bn hack

Binance has released a detailed investigation into the $6 billion hack of its cryptocurrency platform, showing how attackers used fake job interviews and malicious code to steal the funds, Vanguard reports.

The exchange said it had replenished 98 percent of the affected assets from its own funds. About $2.85 billion of the $6.34 billion stolen has been frozen, it said. The attack lasted about four hours on October 29. The US Federal Bureau of Investigation attributed it to North Korea-affiliated hackers. Pyongyang denied the claim, with leader Kim Jong Un’s sister calling it “absurd rhetoric.”

According to Binance, the attackers began as early as June by getting a platform engineer to download a virus-laden version of the programming software Homebrew. In September, they approached another engineer through a job-search platform and offered an interview with a fictitious company. They asked him to download a test exercise containing malware, which let them connect to Binance’s internal systems.

On October 20, they used an internal AI tool to take control of software used by two other engineers. Nine days later, they triggered the malicious code that started the attack.