A multi-stage campaign involving fake job interviews and malicious software resulted in a $6.3 billion cryptocurrency theft from Binance.
By Hermes-Vector AI Desk
Binance has released an initial assessment regarding a $6.3 billion cyber heist, which the company describes as a "sophisticated, multi-stage campaign" that resulted in the theft of customer funds.
According to Binance, the campaign began in June when a staff member on the wallet development team downloaded a tampered version of an AI coding tool. While Binance detected the intrusion and replaced the device, the hackers used the opportunity to learn about the roles of employees on the wallet team.
In September, a different software engineer was contacted on a job-hunting platform by an individual posing as a "project director" for a fictitious company. The engineer participated in interviews with a supposed HR representative and a supposed CEO. During these interactions, the hackers used personal photos and social media accounts to "build trust," according to Binance. The engineer was eventually asked to download a coding "assignment" on a work laptop, which contained malicious code.
On October 20, the attackers used the compromised computer and an internal AI tool to gain control of the devices of two other wallet engineers. On October 29, the hackers used stolen credentials to access a service that approves transfers, allowing them to move funds without the exchange's normal withdrawal process. The theft reportedly took approximately twenty minutes to execute.
Binance stated it has taken several actions, including an independent cybersecurity review and increasing investment in AI-based anomaly detection. As of October 31, the exchange reported it had replaced 98% of the affected assets and has pledged to reimburse customers for their losses. Binance also noted that approximately $2.85 billion in stolen assets had been frozen or intercepted.
The FBI has attributed the October 29 theft to a North Korean military unit known as TraderTraitor. North Korea has denied involvement; Kim Yo Jong, the sister of North Korean leader Kim Jong-un, called the FBI's claims a "grave political provocation" and "an absurd rhetoric."
This incident represents what Binance describes as the world's biggest-ever cyber heist. Experts note that North Korean operatives have long used methods such as posing as job seekers to fund state programs. Jonathan Levin, CEO of Chainalysis, stated that stolen assets are expected to be moved through a wide network of services, such as bridges and instant exchanges, to facilitate money laundering.
Sources
This article was drafted with AI assistance and checked against the sources above. Company claims are reported as claims. Cover image is AI-generated.
The day's checked news, by email
One short email a day with the top stories. Free, and you can unsubscribe in one click.
Or follow for the latest news:
No comments yet. Start the discussion.
Investigators found the Learjet's left elevator several miles from the crash site, suggesting the aircraft may have broken apart before impact.
Apple is reportedly working on a motorized smart-home display, code-named J595, which could feature a 9-inch screen and autonomous capabilities.
