Binance Says $6.34bn Crypto Heist Followed Malware and Fake Job Interviews - Startups and venture capital

The exchange says an attack that began with a malware download in June culminated in the theft of billions from its hot wallets. Binance says $2.85bn has been frozen or intercepted.

Binance says hackers used malware, fake job interviews and an internal AI tool in an operation that compromised the cryptocurrency exchange and drained $6.34bn from its wallets. The company’s account traces the attack from an accidental malware download in June to a theft from its hot wallets last week.

According to an update released on Tuesday, the initial infection exposed an engineer’s role and information about colleagues responsible for Binance’s cryptocurrency wallet infrastructure. In September, a fake project director approached another engineer through a legitimate job-hunting platform. The engineer was led through video and chat interviews with people posing as a recruiter and the chief executive of a fictitious company, then tricked into downloading malware.

Binance said that on 20 October an attacker used the compromised computer and an internal AI tool to gain control of that engineer’s system and the computer of a second wallet developer. On 29 October, the attacker used the second developer’s computer and credentials stolen from the first engineer to run a malicious script and launch the attack.

The company said $2.85bn of the $6.34bn taken from its cryptocurrency wallets had been frozen or intercepted. Binance apologised for the concern and disruption caused to users, partners and the wider industry.

The FBI has blamed North Korea for the heist. On Tuesday, Kim Yo-jong, the sister of North Korean leader Kim Jong-un, rejected the accusation as “absurd rhetoric,” according to the state news agency KCNA.

Sources: The Guardian Business.