Researchers warned of North Korean hacking tactics years before record $6.3B Binance heist

Crypto giant Binance says North Korean hackers used fake social media profiles and the lure of a potential job offer as part of a months-long scheme aimed at tricking an employee into downloading malicious software onto their laptop.

Researchers have repeatedly warned about long-running social engineering attacks that can go on for months.

This latest attack allowed the hackers to patiently worm their way into Binance’s systems to steal a record $6.3 billion in crypto last week, the company has now confirmed. The hack, disclosed in an updated statement posted on X on Tuesday, prompted the world’s largest crypto exchange to suspend customer withdrawals across its network. 

The FBI and blockchain investigators have blamed North Korea for the heist. The country has been long accused of carrying out massive cryptocurrency thefts in recent years to fund its internationally sanctioned nuclear weapons program.

In its latest statement, Binance said that North Korean hackers, posing as recruiters hiring for a job, contacted a software engineer who works on wallets at the company. Following two interviews with the purported company, the engineer was instructed to download an apparent coding assignment as part of the interview process. When opened, the assignment contained malicious code that compromised the engineer’s work-issued laptop. Binance said its security tools did not detect the malware.

That foothold in Binance’s network allowed the hackers to access an internal tool capable of taking over the work computers of two other engineers on the wallet team. One of those engineers had unwittingly downloaded a tampered app containing password-stealing malware months earlier after searching for the software in search engine results. While Binance replaced that compromised engineer’s laptop, the hackers used the engineer’s stolen credentials to break into the computer of a third engineer, whose job allowed them access to systems capable of controlling billions of dollars in crypto.

Binance said the attack “should not have happened,” and that it had improved its network security following the theft.

The hack underscores an ongoing tactic in the North Korean regime’s repertoire of attacks targeting the crypto industry and high-net worth individuals. Researchers have warned for years that North Korean hackers pose as venture capitalists, investors, and recruiters using dossiers of stolen American identities to trick employees into granting access to their systems. 

These attacks are widely known across the crypto industry and have been the subject of repeated warnings from the U.S. government and cybersecurity giants in recent years. Some half of all intrusions at U.S. tech companies last year were attributed to North Koreans posing as remote IT workers and fake recruiters.

By Binance’s own account, the company faced at least 57 suspected attacks from North Korea, which it said reflect the “persistent threat posed by state-sponsored actors targeting the cryptocurrency industry.”

But how the hackers were able to convince the engineer into downloading malware given the highly publicized threat, and bypass security weaknesses in Binance’s own network, will likely be the focus of investigators’ attention.

While the case exposes how North Korean hackers use social engineering, such as offers of employment, to trick employees into granting access to their systems, it’s ultimately the responsibility of the company to ensure its systems cannot run unauthorized or untrusted software that could cause a compromise.

Binance spokesperson Ross O’Leary referred to the company’s public statement but declined to answer TechCrunch’s questions on the record about the incident. Those questions included how Binance prevents unauthorized or malicious code from running on its employees’ laptops, if at all, and whether any third parties had performed cybersecurity audits of Binance’s network prior to the hack.

The company said it would bring in cybersecurity experts to review the incident and has put new security measures in place to prevent a repeat incident. 

The heist remains the largest theft of crypto in history.