A Fake Job Interview Opened the Door to Binance’s $6.3 Billion Crypto Heist
A Fake Job Interview Opened the Door to Binance’s $6.3 Billion Crypto Heist
The path to what Binance calls the largest theft in crypto history did not begin with a technical assault. It began, the exchange says, with a recruiter.
In June, attackers allegedly began probing Binance’s wallet team. By September, someone posing as a project director contacted a software engineer through a job platform. Two interviews followed, including a video call with a purported human-resources representative. The final “assignment” was malicious software, downloaded onto the engineer’s work computer and missed by Binance’s security tools.
On Oct. 20, according to Binance’s account, the attackers used that compromised machine and an internal AI tool to take over the work computers of two wallet-team engineers. One had authority to deploy software. Nine days later, that access opened a transaction-signing service; attackers then drained hot wallets for nearly four hours. “This should not have happened,” Binance said.
The company’s version of events makes the breach less a story of a single broken control than of patient deception meeting powerful internal access. It says simply halting withdrawals could not immediately stop the transfers because the attackers had gained partial control of an Ethereum account whose permissions were recorded on the blockchain. Binance says about $2.85 billion has been frozen or intercepted, 98% of affected tokens have been replenished, and it will cover customer losses.
On Saturday, the FBI attributed the operation to TraderTraitor, a North Korean hacking unit. North Korea denied responsibility. Binance says it has blocked 57 other suspected North Korean hacking attempts this year and is rebuilding affected systems, bringing in outside reviewers and pursuing new safeguards with AI companies.
The wider warning is not confined to crypto. In a separate U.S. case, prosecutors charged three people with using AI to impersonate executives and lawyers in an alleged $129 million fraud scheme—evidence that synthetic credibility is becoming a frontline security problem, not a futuristic one.
Write a comment