Binance says fake job interviews led to $6bn crypto hack

Binance said hackers used fake job interviews and malicious code to carry out a $6 billion theft from its cryptocurrency platform.

The crypto exchange released an investigation on Tuesday into the attack, which it said took place over about four hours on October 29. Binance said the attackers stole $6.34 billion and that about $2.85 billion had been frozen, preventing the attackers from using it or converting it to another currency.

The company said it had replenished 98 percent of the affected assets using its own funds. It said the remaining amount involved little-traded currencies that are harder to acquire.

The US Federal Bureau of Investigation attributed the attack to North Korea-affiliated hackers. Pyongyang denied the allegation, and Kim Jong Un's sister called the claim “absurd rhetoric.”

Binance said the attackers began as early as June by targeting a platform engineer with a virus-laden version of the programming software Homebrew. It said cybersecurity teams identified and removed the malware, but not before the hackers collected information about the engineer and colleagues.

In September, Binance said, attackers contacted another engineer through a legitimate job-search platform, offered an interview for a fictitious company and later asked the engineer to download a test exercise containing malware.

Binance said that malware helped the hackers connect to internal systems. On October 20, it said, the attackers used the access and an internal AI tool to gain control over software used by two other engineers, before triggering malicious code nine days later.