Binance reported on Tuesday that before carrying out the largest theft in the history of cryptocurrency, hackers used a variety of methods to infiltrate the company, including fake job interviews.
The world's largest cryptocurrency exchange disclosed the investigation results in a preliminary report, detailing how hackers gained access to the company's wallet system before stealing $6.3 billion in crypto assets on October 29th.
Binance CEO Richard Teng stated on X on Tuesday that this hacker attack was "an operation that lasted for several months" and called it "one of the most complex attacks seen in the digital asset industry."
The Federal Bureau of Investigation (FBI) has stated that North Korean hackers are behind this theft case, however, North Korea denies any involvement.
According to Binance, the theft began in June when an engineer from their wallet infrastructure team downloaded a tampered version of the AI programming tool.
Richard Teng wrote in a post on X:
On October 29th, Binance became the target of one of the most complex attacks in the digital asset industry. Approximately $6.34 billion in assets were affected. We take full responsibility and will rectify the situation. No users will suffer any losses. We have reserved more than the required amount of funds. Currently, 98% of the affected tokens have been recovered; we are working to complete the recovery of the remaining 2%. The withdrawals have largely been restored. This was not a mistake or a single intrusion, but rather an operation that lasted for several months. We are releasing a full report because the lessons learned from this incident are far-reaching beyond Binance. With the assistance of law enforcement agencies, issuers, and blockchain intelligence companies, approximately $2.85 billion has been frozen or intercepted. Such coordination speed is unmatched in traditional finance.
According to Binance, in September, a software engineer from the company was contacted through a "legitimate job-seeking platform," and the person on the other end claimed to be the director of a certain project.
The employee's profile on that platform mentions his work experience at Binance, which is represented by Binance.
Binance said, 'The so-called project director arranged the first round of interviews with a representative from human resources, and then arranged a second round of interviews with someone who claimed to be the CEO of a fictitious company.'
Binance indicates: "The repository contains malicious code that will be executed during the setup process, thereby initiating a series of unauthorized activities."
The company stated that on October 20th, hackers exploited the computer of this engineer that had been compromised and used an internal AI tool to gain control of the systems used by two other wallet team engineers.
On the day of the theft, Binance stated: "The attacker logged into computer C, a software engineer, used credentials stolen from engineer A's wallet DevOps, deployed a container, and triggered a malicious script to launch the attack."
Binance stated on Tuesday that the company is bringing in third-party cybersecurity experts to further investigate this incident, increasing investment in AI driver detection, and is working to establish a research fund with AI, a company focused on the security of blockchain systems AI.
