Overview
Binance published its account of the record cryptocurrency theft, calling it the culmination of a "sophisticated, multi-stage campaign." Reported totals vary by outlet at about $6.3 to $6.43 billion. Earlier coverage on Labs covered the incident and attribution. This article focuses on the attack chain Binance disclosed on November 3.
Attack Chain
| Stage | When | What happened |
|---|---|---|
| 1. Tampered install | June | A Binance Wallet DevOps engineer searched for a popular AI coding tool and downloaded a tampered Homebrew installation |
| 2. Fake recruitment | September | A second engineer was approached on a legitimate job-hunting platform by a "project director" at a fictitious company, then interviewed by a supposed HR manager and "CEO" |
| 3. Malicious test assignment | September | The engineer was asked to download a test assignment to a work computer; it contained malicious code |
| 4. AI tool abuse | October 29 | Attackers used the compromised machine and an internal AI tool to reach wallet infrastructure and carry out the theft |
Attribution and Response
Co-CEO Richard Teng did not himself attribute the attack, but acknowledged that the FBI has linked it to North Korean actors associated with TraderTraitor. Binance says it has frozen or intercepted about $2.85 billion and replenished 98% of the impacted assets. It has rebuilt the wallet system, updated its AI tools and access controls, and replaced affected devices. The company says it has foiled 57 suspected North Korea-linked threats this year.
Lessons for Defenders
- Search-engine installs are an attack surface. Install developer tooling only from verified vendor sources and verify installer integrity.
- Recruitment is an intrusion vector. Never run take-home assignments on corporate machines. Use disposable, isolated environments.
- Internal AI tools inherit privilege. An AI assistant with reach into sensitive systems lets a compromised endpoint act with that reach. Scope its access and log every action.
- Segment wallet infrastructure from developer workstations, and require out-of-band approval for high-value transactions.
- Train staff on targeted social engineering, especially engineers who are being recruited.
Sources
- Binance Reveals How Fake Job Interviews and AI Tool Abuse Led to $6.43 Billion Theft — The Hacker News
- Binance says fake job interview led to $6.3 billion crypto heist — BleepingComputer
- Binance co-CEO Richard Teng says hackers used fake job interviews, AI tool — CNBC
- Binance's $6.3 billion hack began with a fake job — Axios
- Binance hack incident report — The Block