WORLDTECHBinance Attributes $6.4 Billion Theft to North Korean Fake Job Interviews
Binance says the $6.4 billion theft by North Korean actors began with employment fraud, a tactic Chainalysis says the country's hacking teams have relied on for years. The cryptocurrency exchange and finance company, based in the United Arab Emirates, released its initial findings on Tuesday.
How the intrusion unfolded
According to Binance's initial findings, the attack began in September, when an engineer was invited to a job interview. Over several weeks the attackers built trust with a Binance employee, first contacting that person through a legitimate job platform with an offer of work.
After two rounds of interviews with a fictitious company, the employee was asked to download an interview assignment containing malicious code. That gave the attackers their first foothold, from which they deployed malware and used access to an internal AI tool to penetrate further into Binance's systems.
A tactic seen in earlier cases
Chainalysis investigators have tracked this approach for years. Alec Zebrick, Chainalysis Senior Manager of Global Services, has described what he calls "contagious interviews", in which North Korean actors target staff with privileged access and use their credentials and permissions to get into internal systems.
Over the past 18 months, Chainalysis has linked more than $14.3 million in losses to similar North Korea-linked schemes involving fake interviews and malware. The targets have ranged from individual crypto holders and private wallets to organisations, protocols and DAOs, and losses in those earlier incidents ran from tens of thousands to millions of dollars.
What earlier cases may have taught attackers
Chainalysis suggests the bigger significance of these earlier incidents may lie in what they taught the attackers. Across successive compromises, North Korean actors were refining their methods, McLouth said, and may have been developing the capabilities needed to go after increasingly valuable victims.
The Binance case shows how a fake interview can open a route into a major organisation. Chainalysis describes it as one example of North Korea's illicit employment ecosystem, which also includes other fake recruitment schemes and fraudulent IT employment.
Open questions
- Which of the access routes described by Binance remains unconfirmed?
- How much of the $6.4 billion has been recovered?