Binance loses $6.3 billion in fake job interview malware attack
Original title: Binance says fake job interview led to $6.3 billion crypto heist
North Korean hackers used fake job interviews to install custom malware and steal $6.34 billion from Binance's wallet infrastructure.
Cryptocurrency exchange Binance says North Korean hackers used a fake job interview to trick an employee into installing malware that ultimately let them compromise the company's wallet infrastructure and steal about $6.34 billion in digital assets. The attack began in September when a software engineer was contacted through a legitimate job-hunting platform by someone impersonating a Project Director at a fictitious company. The fake recruiter scheduled two interviews for the employee, first with someone posing as a human resources representative, then with another individual claiming to be the company's CEO. During the first interview, the fake HR representative held a live video call and shared a social media account with personal photos and videos to build trust. The second interview took place through a popular social chat application where the employee was instructed to download a coding assignment from an online code repository containing malicious code. The malware employed sophisticated obfuscation and evasion techniques, including replacing a legitimate development tool component with a malicious version to execute commands and establish communication with an…
Unconfirmed: FBI attribution to Lazarus Group, also known as TraderTraitor, Jade Sleet, and APT38
- Attack began in September via fake job offer on legitimate platform
- Malware replaced legitimate pyenv executable with malicious version
- Compromised credentials used on October 29 to access wallet signing service
- Abused Ethereum EIP-7702 authorization mechanism to continue stealing
- $2.85 billion frozen or intercepted as of November 3
Impact: unauthorized access to wallet infrastructure and theft of $6.34 billion
| Product | Affected |
|---|---|
| Binance wallet infrastructure | — |
- 1.rebuild affected systems
- 2.replace compromised devices
- 3.revoke stolen credentials
- Vendors
- binance
- Threat actors
- Lazarus Group
- Victims
- Binance
- Countries
- North Korea
From the original article
3 min read at bleepingcomputer.com
Cryptocurrency exchange Binance says North Korean hackers used a fake job interview to trick an employee into installing malware that ultimately let them compromise the company's wallet infrastructure and steal about $6. 34 billion in digital assets. [...]
By Lawrence Abrams · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.