Binance recruiting campaign reached wallet transaction systems
Binance says a North Korean campaign that began in June led to a $6.3 billion cryptocurrency theft discovered in October, after attackers compromised multiple employees and reached systems tied to wallet transactions.
The attackers posed as recruiters and sent a wallet engineer a coding assignment containing malicious code. Binance says it detected an earlier infection and replaced that device, but a later infection evaded endpoint tools. From the foothold, attackers used an internal tool to access other engineers’ computers and stolen credentials to reach a third engineer with access to systems controlling billions in crypto.
For exchanges where developer devices connect to internal tools and wallet systems, replacing an infected laptop may leave exposed credentials and access paths intact. The campaign shows how a hiring exercise can become a route from one employee’s device to high-value transaction systems.
Binance CEO says ‘months-long campaign’ led to $6.3 billion theft as N. Korea denies responsibility
North Korean attackers "combined a range of techniques, including social engineering by fake recruitment interviews," Binance said about the multibillion-dollar crypto heist it discovered in October.