Binance Holdings Ltd. said Tuesday that the hackers behind a $6.3 billion heist used social engineering techniques including fake job interviews, as well as malicious software, in the most detailed report yet on how the incident unfolded.
Binance, which attributed the hack to North Korea, said the breach involved a “sophisticated, multi-stage campaign.” One of the company’s engineers was contacted through a job hunting platform by someone posing as a project director, the exchange said in the report published Tuesday. The employee was then interviewed by a person claiming to be the chief executive officer of a fictitious company over a social chat app, and asked to download an assignment containing a “malicious code repository.” This then set off a series of unauthorized activities, the report said.
“This was not a single mistake or a single breach. It was a campaign built over many months,” said Richard Teng, co-chief executive officer of Binance. The attackers “combined fake recruitment interviews, malicious software disguised as legitimate developer tools, compromised devices, and AI techniques.”