Binance Holdings said on Tuesday that hackers used social engineering tactics, including fake job interviews, along with malware in a theft that resulted in losses of $6.3 billion. This is the most detailed account to date of how the incident unfolded.
Binance attributed the hack to other countries and stated that the breach involved a "sophisticated, multi-stage operation." In a report released on Tuesday, Binance said that an engineer at the company was contacted on a job platform by someone posing as a project director. Subsequently, an individual claiming to be the CEO of a certain company conducted an interview with the employee via a social chat app and asked them to download an assignment that contained a "malicious code repository." The report said this triggered a series of unauthorized activities.
Binance co-CEO Richard Teng stated, "This was not a single mistake, nor a single intrusion, but an operation planned over several months." The attackers "combined fake recruitment interviews, malware disguised as legitimate development tools, compromised devices, and artificial intelligence technology."
Nine days before the hack occurred, attackers used the laptop of the employee who had been tricked into the fake job interview to further infiltrate the computers of two other software engineers responsible for Binance's digital wallets. Binance's report stated that the hackers used an "internal AI tool" to gain access, but did not specify what the tool was or explain how the attackers used it to control these employees' laptops. The report said that one of the two engineers accidentally downloaded malware in June while trying to install what Binance called "a popular AI programming tool," which allowed the hackers to learn the engineer's specific responsibilities and the nature of the work of some colleagues responsible for Binance's wallet operations.
Binance disclosed more details about the hackers' theft of billions of dollars in assets. Currently, the exchange and the entire cryptocurrency industry are still struggling to recover from the impact of the largest hack in the history of cyber theft. This breach has further exacerbated the growing security crisis in the cryptocurrency industry, which was already dealing with a wave of cyberattacks. Artificial intelligence has added to the threat, providing criminals with new tools to find security vulnerabilities and deceive employees, and exposing platforms that safeguard billions of dollars in digital assets to higher security risks.
Hours after the hack, Binance initially stated that attackers may have compromised a software engineer's laptop, allowing thieves to withdraw cryptocurrency from the exchange. Binance later posted that the attack was "very sophisticated" and that the company had "discovered more intrusion points," but did not disclose further details at the time. Shortly after the attack, traders, cybersecurity professionals, and token issuers took action to address the aftermath. Stablecoin giant Tether and Circle Internet Group Inc., among others, quickly froze nearly $3 billion in funds or took measures to prevent hackers from moving the money. Analytics firms also quickly tracked the flow of cryptocurrency, while some traders profited from market turmoil.
Throughout the incident, Binance sought to reassure users and stated it would bear the related economic losses. However, the exchange suspended withdrawals for nearly two days after the incident. Early on Sunday, Binance began gradually restoring user withdrawals. Initially, Binance saw billions of dollars in outflows, but the situation appears to have stabilized since then. Binance said on Tuesday that hourly deposits had begun to exceed hourly withdrawals. Binance also said it has largely replenished the cryptocurrency stolen by hackers, using funds from the company's own resources and two insurance funds. Binance is also cooperating with U.S. law enforcement, including the Federal Bureau of Investigation (FBI), the Secret Service, and the Department of Justice. The FBI intervened shortly after the hack to assist Binance and similarly attributed the breach to hackers.
Comments