Hackers linked to North Korea stole cryptocurrency worth USD 6.3 billion from Binance. They got in through a fake job offer sent to one of the company's engineers. The crypto exchange shared the details in its latest review of the attack. The FBI and outside investigators also blame North Korea, though the probe is still ongoing.
The target was a software engineer who worked on the exchange's wallets. The hackers posed as recruiters and held two interviews with him. They then asked him to download a file containing a coding task. The file hid harmful code. It infected his work laptop, and Binance's security tools did not catch it.
From there, the hackers reached an internal tool. It could control the computers of two other wallet engineers. One of them had earlier installed a malicious app he found through a search engine. The app had stolen passwords.
Also Read: North Korea Rejects Allegations of Record USD 6.3 Billion Binance Crypto Hack
Binance replaced the infected laptop. But the hackers still held stolen passwords. They used them to get into another engineer's computer. This engineer had access to systems that hold billions of dollars in assets. That gave the attackers access to systems at the core of the exchange's operations.
Experts say this trick is not new. Researchers warned about it years before this theft. North Korean groups pretend to be recruiters, investors, or venture capitalists. They also use stolen identities to make fake profiles look real. Binance says it has faced at least 57 suspected attacks linked to North Korea.
Binance acknowledged that the attack should not have happened. It has added new security steps and plans to bring in outside experts to review what went wrong.
The case shows why firms need tighter rules on what staff can install on work devices. It also shows how one trusted download can put huge sums at risk.