"Even the CEO Personally Interviewed Me"... 'Fake Hiring' Behind a KRW 8.4 Trillion Hack [Crypto Radar]

Binance Releases Preliminary Investigation Report
A Meticulously Planned Infiltration Over Five Months
Deceived Employees by Posing as Interviewers and CEO

In September, an engineer at Binance, the world's largest cryptocurrency exchange, was approached with an opportunity to interview for a job. The interviewer, who had contacted the engineer through a job-search platform, built trust during a video interview by even sharing a social media account containing personal photos. In the second interview, a person posing as the CEO of a fictitious company also appeared. The person asked the engineer to install specific software to complete a hiring assignment.

But they were neither real interviewers nor a real CEO. The attackers, suspected of being part of a North Korean hacking group, had staged a fake hiring process to infiltrate Binance's internal systems. The software disguised as an interview assignment concealed malware. The hackers used it to infect an employee's work computer and even exploited the company's internal artificial intelligence (AI) tools to steal critical authentication keys. This is how the massive Binance hack that took place on October 29 (local time) unfolded.

On November 3, Binance released a preliminary investigation report detailing the incident. According to the report, the hackers carried out a multi-stage attack over about five months, beginning in June, combining a software supply chain attack, social engineering techniques, and the exploitation of internal AI tools.

A Carefully Planned Infiltration Spanning Five Months

The attack began in June. The hackers initially targeted Engineer A, who was responsible for developing and operating Binance's cryptocurrency wallets. It was a so-called "supply chain attack," in which the hackers lured the engineer into downloading malicious software disguised as legitimate development tools.

At the time, Binance's security team detected suspicious activity. The company responded by replacing devices suspected of being infected and updating authentication credentials. However, during this process, the hackers obtained personal information about members of the wallet infrastructure team.

About three months later, the hackers changed their approach. This time, they targeted people rather than systems. They contacted Engineer B through a job-search platform and conducted an interview staged to look like a genuine hiring process. It was a "social engineering attack" aimed at gaining the target's trust and bypassing security procedures.

During the first video interview, a hacker posing as a recruiter shared their social media account to avoid suspicion. In the second interview, a person posing as the CEO of a fictitious company appeared and asked the engineer to install software under the pretext of completing an assignment.

The program B downloaded contained malware. Using a "zero-day" vulnerability that security tools at the time could not detect, the malware replaced legitimate development tools with malicious versions. A computer used for routine work had become a means for hackers to infiltrate the company.

The hackers' next target was Binance's internal AI tools. On October 20, they exploited the company's AI tools using B's infected computer as a foothold. This allowed them to gradually gain control over Engineer A, who had been targeted earlier, as well as another engineer, Engineer C.

In particular, the hackers succeeded in stealing a "container deployment access token" held by A. This is a type of digital authentication key that allows developers to deploy programs they have created to live production systems. By obtaining this key, the hackers also gained the ability to deploy malicious programs they had created to Binance's internal systems.

Malicious Programs Deployed Using Stolen Authentication Keys

Reuters-Yonhap

The hackers began stealing cryptocurrency in earnest on October 29, about five months after their initial infiltration attempt.

After logging in to Engineer C's computer, the hackers used A's previously stolen authentication key to deploy programs they had created. They then began siphoning cryptocurrency to external addresses, bypassing the standard withdrawal process.

The attack began at 8:05 p.m. UTC on October 29, or 5:05 a.m. Korea time on October 30. In just four minutes, the hackers illegally withdrew 233.46 million XRP. They then transferred 970,500 Solana (SOL) and 44.2 million Optimism (OP) to external addresses. They also transferred 18,270 Bitcoin and 2,961.9 Ethereum.

On the Ethereum network in particular, the hackers exploited an authorization feature known as "EIP-7702." EIP-7702 is a technology that allows an account to delegate its functionality to a smart contract. Through 50 signed transactions, the hackers manipulated the value that controls the order of transactions in an account and delegated asset transfer authority to smart contracts under their control.

The investigation found that this allowed them to bypass Binance's normal withdrawal system. They exploited the fact that delegated permissions set on the blockchain could continue to operate independently even if the withdrawal function was suspended.

Binance blocked further outflows about four hours after the attack began. At 12:10 a.m. on October 30 (9:10 a.m. Korea time), the company reset the EIP-7702 delegation code. By then, however, a substantial amount of cryptocurrency had already been stolen.

The total value of the cryptocurrency affected by the incident reached $6.34 billion (approximately KRW 8.4 trillion). Of that amount, $2.85 billion (approximately KRW 3.8 trillion) was frozen or blocked through cooperation with exchanges and cryptocurrency issuers.

Binance said it had replenished more than 98% of the affected cryptocurrency as of October 31, using its own funds, its Secure Asset Fund for Users (SAFU), and its futures insurance fund. It is also purchasing the remaining assets, which have low liquidity.

Kim Yo Jong, younger sister of North Korean leader Kim Jong Un and director of the Workers' Party's General Affairs Department, attends a wreath-laying ceremony at the Ho Chi Minh Mausoleum in Hanoi, Vietnam, on March 2, 2019. AP-Yonhap News

Binance has rebuilt the compromised cryptocurrency wallets and internal AI tools and is conducting a security audit with an independent external organization. It also plans to increase investment in AI-based threat detection technology and establish a fund for AI security research in the cryptocurrency sector with major AI companies. Binance said it had detected and blocked 57 suspected cyberthreat incidents linked to North Korea this year.

The United States and North Korea are trading accusations over who was behind the incident. The U.S. Federal Bureau of Investigation (FBI) pointed to North Korea and announced on October 31 that the perpetrators were TraderTraitor, a North Korean elite hacking group. In response, Kim Yo Jong, director of the Workers' Party's General Affairs Department, denied the allegations in a statement on November 2. A U.S. State Department official pushed back, saying, "North Korea's cybercrime is a global problem."

This content was produced with the assistance of AI translation services.