A fake job interview trick involving Binance hack tactics led to the largest cryptocurrency heist in history, resulting in the theft of approximately $6.34 billion (approx. 8.5 trillion KRW). Hackers utilized social engineering techniques, combining malicious code disguised as artificial intelligence (AI) coding tools and fake hiring interviews, to breach the security of the world’s largest cryptocurrency exchange, Binance.
Binance released an initial investigation report regarding the hacking incident, which took place on November 29, revealing the staggering scale of the breach. The U.S. Federal Bureau of Investigation (FBI) pointed the finger at the North Korean hacking group ‘TraderTraitor,’ the same organization responsible for stealing $1.5 billion from the Bybit crypto exchange in February of last year. Although Binance stated it successfully blocked 57 suspected North Korea-linked hacking attacks this year alone, this latest attempt managed to break through their defenses.
According to the report, the attack originated back in June when a developer managing Binance’s wallet system searched for AI development tools on a search engine and downloaded a modified installation file. Although the security team detected abnormal signs, replaced the PC, and updated authentication credentials, the organizational chart of the wallet management team and the personal information of fellow developers had already fallen into the hands of the hackers.
In September, the hackers targeted another engineer within Binance. They approached an engineer who had publicly listed their work history at Binance on a job-hunting platform, posing as a fictitious company called ‘Project Director’ to offer a job transition. During the first-round interview, a fake human resources manager built trust by showing social media accounts containing personal details. In the second round, a fake CEO recommended that the engineer install an ‘assignment file,’ which was actually malicious code disguised as an AI development tool. Because the malware was novel, security programs failed to detect it.
Using the engineer’s work PC as a stepping stone, the hackers secured control over the PCs of the wallet development team. This allowed them to bypass withdrawal procedures and drain cryptocurrencies such as Bitcoin and Ripple. It took approximately four hours for Binance to suspend withdrawals and regain control of the systems.
In the report, Binance stated that it froze and blocked approximately $2.85 billion of the $6.3 billion in stolen cryptocurrency and that the company will absorb the remaining losses. Furthermore, the exchange decided to rebuild its wallet system and internal AI tools. However, experts predict that AI-driven attacks by hackers will only intensify. During an interview with CoinDesk on the same day, Binance founder Changpeng Zhao remarked that 100% secure systems do not exist and that as AI advances, such hacking incidents will become much more frequent.
