LONDON (The Thursday Times) — The record $6.3bn theft from Binance began with a fake job interview, the cryptocurrency exchange said on Tuesday, in its first account of how hackers got inside its systems.
Binance said one of its engineers was contacted through a legitimate job-hunting platform and invited to interviews with fake company representatives. The hackers built trust with him by sharing social media accounts full of personal pictures. During the second interview he was told to download an “assignment”, which was in fact malware built to avoid detection.
From that computer, and using an internal AI tool they had also compromised, the hackers took control of the laptops of two more engineers in October, the company said. That gave them the tools to drain its wallets.
“This should not have happened,” Binance said, calling it a “serious and highly sophisticated security incident”. “We apologise for the concern, disruption and uncertainty it caused our users, partners and the wider industry.”
The company says it has set aside more than 100% of the funds needed to cover the loss, and that 98% of the affected token assets had been replenished by Saturday. It is working with law enforcement to trace and freeze the stolen money. Withdrawals resumed on Sunday, after which customers pulled out billions of dollars.
The FBI has blamed North Korea for the hack. Pyongyang denies it, and Kim Yo-jong, the sister of leader Kim Jong-un, called the claims a “sinister attempt” to damage its image.
The account carries a warning for anyone hunting for work online, including the many Pakistani developers and freelancers who do so: be careful with any recruiter who asks you to download and run a test file.
