A Binance engineer thought he was interviewing for a job. Then the hackers pounced

Business

A Binance engineer thought he was interviewing for a job. Then the hackers pounced November 3, 20264:30 PM ET

Hackers, widely believed to be from North Korea, duped a Binance engineer into downloading malicious software that allowed them to pull off a $6.3 billion cyber heist of the crypto exchange. Dan Kitwood/Getty Images Europe hide caption

toggle caption i Dan Kitwood/Getty Images Europe

The massive $6.3 billion cyber heist suffered by crypto exchange Binance last week may have taken place in only about twenty minutes — but the attacks were months in the making.

A North Korean hacking unit is widely believed to be behind the $6.3 billion cyber heist of crypto exchange Binance.

Business

A simple explainer of the massive $6.3 billion crypto heist at Binance

That's according an initial assessment released by Binance on Tuesday about how it suffered the world's biggest-ever cyber heist by hackers the FBI has identified as being a North Korean state-sponsored unit.

Those findings show the hackers first tried testing and penetrating Binance's security systems back in June, though the crypto exchange was able to detect that attempt and stop it.

Though unsuccessful, that attempt allowed the hackers — identified by the FBI as a North Korean military unit called TraderTraitor — to learn more about Binance and its systems.

Then, the hackers tried again. In September, a Binance engineer was contacted in a job-hunting platform by a person posing as a "project director" from a company that turned out to be fictious.

The engineer then conducted a first-round interview with a supposed HR representative from the fake company. The hackers used this interview to "build trust," with the Binance employee, the exchange said. The interviewer even shared supposed social media accounts, as well as personal photos and videos with the Binance engineer.

"This was more advanced and deceptive than previously seen social engineering approaches," Binance said in its assessment.

Then hackers pounced

The engineer was then told he would be conducting a second interview with the supposed CEO of the company in a popular social chat app. It was in this interview that the Binance employee — who was at his work laptop — was asked to download "an assignment" as part of the job recruitment process.

A woman walks past empty fresh-food refrigerators at an Intermarché supermarket in Névez, western France, on Oct. 12, following a cyberattack affecting the French supermarket chains Intermarché and Cooperative U that caused their refrigerators to defrost. Some 150 to 200 Intermarché stores were targeted in the attack on Oct. 12, along with nearly 100 Coopérative U outlets, the retailers said.

National Security

A new cold war: hackers target fridges across the globe

Instead, the "assignment" contained malicious code that allowed hackers to build out an attack that culminated last week when hackers made off with over $6 billion worth of crypto currencies held by Binance's customers at the exchange.

Binance said in the statement posted on X that the company is taking a series of actions, including an independent cybersecurity review to prevent future attacks. On Monday the exchange had said it had already replaced most of the stolen crypto currencies stolen by customers using its own funds.

"This should not have happened," Binance said in its assessment on Tuesday. "And we apologise for the concern, disruption and uncertainty it caused our users, partners and the wider industry."

NPR does not offer or accept money for coverage or interviews. Anyone who makes such an offer or request is not an NPR employee and does not represent NPR.