Binance says hackers used fake job interviews and an internal AI tool to pull off the $6.3 billion heist

Your cryptocurrency withdrawals may be temporarily impacted if Binance’s security issues are not fully resolved.

Binance reported that hackers, identified by the FBI as North Korean cyber unit "TraderTraitor," executed a $6.3 billion crypto heist using a multi-stage attack. The breach began in June when a developer downloaded malware from a compromised Google ad, exposing internal details. In September, another engineer was targeted through a fake job interview process that involved downloading malicious software disguised as an assignment. This malware replaced a legitimate development tool with a malicious version, granting backdoor access, which Binance's security tools initially missed. By October 20th, the attackers utilized Binance's internal AI tool to compromise wallets linked to two employees. On October 29th, they gained full control of a third employee's computer, initiating unauthorized transfers. Binance explained that the use of Multi-Party Computation (MPC) for hot wallets prevented immediate revocation of malicious authorizations. Binance stated that 98% of impacted tokens have been replenished, and no user funds were lost, with $2.85 billion of stolen assets frozen or intercepted.

The sophisticated nature of this attack, involving social engineering, zero-day malware, and exploitation of internal AI tools, highlights evolving threats in the cybersecurity landscape. The incident underscores the critical importance of robust endpoint security and anomaly detection, especially when sophisticated evasion techniques bypass existing protections. Binance's reliance on its own AI tool for malicious operations by attackers suggests a potential vulnerability in how internal AI systems are secured and monitored.

The attackers' ability to gain backdoor access through a manipulated development tool and subsequently leverage Binance's AI for wallet control points to a deeper systemic risk within the company's infrastructure. The use of MPC wallets, while designed for security, also presented a challenge for immediate incident response, indicating a need for improved emergency revocation protocols. This event will likely prompt increased scrutiny of security practices at cryptocurrency exchanges and a greater focus on securing internal development tools and AI platforms.