Binance Says Fake Job Interview Opened the Door to Record $6.3 Billion Crypto Heist

The enormous cyber heist that hit crypto exchange Binance last week, draining $6.3 billion, may have been carried out in only about 20 minutes. The operation behind it, however, was months in the making.

That is the conclusion of an initial assessment Binance released on Tuesday, describing how it fell victim to what it called the world's biggest ever cyber heist. The FBI has identified the attackers as TraderTraitor, a North Korean state-sponsored military unit.

According to the findings, the hackers first probed Binance's security systems back in June, testing ways to penetrate them. The exchange detected that attempt and stopped it, but the effort still allowed the attackers to gather valuable knowledge about the company and its systems.

The hackers then switched to a slower, more personal strategy. In September, a Binance engineer was contacted on a job hunting platform by someone posing as a project director at a company that later proved to be fictitious.

The engineer went through a first round interview with a supposed HR representative from the fake company. Binance said the session was used to build trust with the employee, and the interviewer even shared what appeared to be personal social media accounts, along with photos and videos.

"This was more advanced and deceptive than previously seen social engineering approaches," Binance said in its assessment.

The trap was sprung during a second interview, this time supposedly with the chief executive of the fake company, conducted on a popular social chat app. While sitting at his work laptop, the engineer was asked to download what was described as an assignment as part of the recruitment process.

Instead of a job task, the file contained malicious code. That foothold allowed the hackers to build out an attack that culminated last week, when they made off with more than $6 billion worth of cryptocurrency that Binance customers held at the exchange.

Binance said in a statement posted on X that it is taking a series of actions, including an independent cybersecurity review, to prevent future attacks. On Monday, the exchange said it had already replaced most of the cryptocurrency stolen from customers using its own funds.

"This should not have happened," Binance said in its assessment on Tuesday. "And we apologise for the concern, disruption and uncertainty it caused our users, partners and the wider industry."