The incident report published by Binance revealed the initial entry point of the attack in which roughly $6.34 billion in digital assets was transferred on October 29. According to the company, what opened the door wasn’t a firewall vulnerability, but the curiosity of a software engineer looking for a job.
The lure that started on LinkedIn
In September, an engineer working on Binance’s wallet team was contacted through a legitimate job search platform by someone presenting themselves as a project director. The interview process was staged from start to finish. In the first round, there was a live video call with someone acting as an HR representative; to appear trustworthy, the other side even shared a social media account filled with personal photos and videos. The second round took place over a chat app with someone claiming to be the company’s CEO.
This method, used for years by North Korea-linked groups, is known in security literature as a fake job interview campaign. The target selection isn’t random; senior developers with access to wallet infrastructure are specifically sought out.
A poisoned coding assignment
At the end of the second interview, the engineer was asked, under the pretext of a technical assignment, to download and run a code repository on their work computer. The malicious code in the repository replaced a legitimate component of a popular developer tool with its own version during installation. According to Binance’s report, this malware was previously unseen, custom-built, and went undetected by endpoint security tools.
The malware didn’t perform any actions that would trigger alerts. It settled onto the device and waited to receive commands from the attackers, while monitoring movement across the internal network for months. This quiet waiting phase was the main reason the incident went unnoticed for so long.
The company’s internal AI tool became a springboard
On October 20, the attackers used the compromised computer and the company’s internal AI tool to reach the systems of two engineers working on the wallet infrastructure. At this stage, credentials and a container deployment token were obtained. The corporate AI assistant was used here for both reconnaissance and lateral movement.
On October 29, using the stolen credentials, a malicious script was deployed and unauthorized access was gained to the exchange’s wallet signing service. Transfers were initiated simultaneously across multiple blockchains.
$2.85 billion was frozen
Binance said that about $2.85 billion was frozen or blocked, and that 98% of the affected assets were reimbursed. The company announced that user funds were not harmed and that the shortfall was covered from its own security reserve.
The FBI attributed the attack to the TraderTraitor cluster linked to the North Korean state; the same group is also tracked under the names Lazarus and APT38. On-chain analysis firms confirmed that the recipient addresses belonged to this operation.
The hiring process is now an attack surface
The most striking part of the incident is that the technical layers of defense were not bypassed. The attackers didn’t crack passwords or run a zero-day browser exploit; they simply used one person’s interest in a career opportunity. That’s why the first rule for organizations is that no code from an external source should ever be run on a non-isolated workstation. Second, identity verification in hiring processes should go through a separate security check. Third, the permissions of internal AI tools should be controlled just as tightly as the systems they can access.
Source: WebTuring
Share your experience
Bir sorunun, farklı bir çözümün veya eklemek istediğin bir notun var mı? Giriş yapmadan da yazabilirsin.