Abstract:
The latest investigation details disclosed by Binance, the world's largest cryptocurrency exchange, show that the cyber attack that resulted in the theft of $6.3 billion in crypto assets was not a sudden operation, but a carefully planned social engineering penetration operation that lasted for several months. In fact, security researchers have been warning the industry about similar attacks for years, but this incident, which set the record for the largest theft in the history of the cryptocurrency industry, still happened.
According to the latest description released by Binance on November 3, North Korean hackers posed as recruiters and contacted a software engineer responsible for the wallet business through a false social media identity. After two rounds of seemingly normal interview processes, the other party asked the engineer to download a so-called programming test task. However, there was malicious code hidden in this document, which once run successfully invaded company computers used by employees, and Binance’s existing security tools failed to detect the related malware.
After the hackers gained initial access, they further used the company's internal systems to expand their results. They gained access to an internal set of tools that allowed them to remotely control other employees' computers, and in doing so, took over the devices of two other engineers on the wallet team.
The investigation revealed that one of the engineers mistakenly downloaded a tampered application while searching for software several months ago, resulting in password-stealing malware being implanted into the device. Although Binance later replaced the infected computer, the hackers continued their activities using the previously stolen credentials and eventually compromised the device of a third engineer. The employee’s job had access to critical systems that managed billions of dollars in crypto assets, setting the stage for the eventual theft.
Binance admitted in a statement that the incident "should not have happened" and said the company had strengthened network security measures after the incident. Affected by the attack, Binance temporarily suspended withdrawal services for platform customers last week.
The FBI and blockchain investigation agency have attributed the attack to North Korea. In recent years, North Korea has been accused of repeatedly stealing crypto assets on a large scale to fund its nuclear weapons program, which is subject to international sanctions.
This incident once again highlights the tactics used by North Korean hackers for a long time. Cybersecurity researchers have been warning for years that North Korean attack groups often pose as venture capital firms, investors, recruitment consultants, and remote IT workers, using stolen U.S. citizen identity information to establish a credible image and trick targets into opening system permissions.
In fact, this type of attack method has long been known in the cryptocurrency industry. The U.S. government and many large cybersecurity companies have issued multiple warnings in recent years. Relevant data shows that nearly half of the network intrusions that occurred in the U.S. technology industry last year alone were attributed to North Korean hackers posing as remote IT employees or fake recruiters.
According to data disclosed by Binance, the company has previously recorded at least 57 attack attempts suspected to come from North Korea. Binance said this fully illustrates the continued threat posed by nation-state attack groups against the cryptocurrency industry.
However, investigators may still focus on two key questions in the future: how the hackers successfully persuaded employees to download malicious programs when such attack methods have been widely exposed; and why Binance's internal network failed to effectively prevent attackers from further lateral penetration and obtaining higher privileges.
Analysts pointed out that although the case once again demonstrated that North Korean hackers are good at using recruitment opportunities and career development temptations to carry out social engineering attacks, companies also bear important responsibilities. Companies not only need to improve employee security awareness, but also must ensure that internal systems cannot run unauthorized or untrusted software at will, and technically reduce the risk of a single point of failure turning into a major security incident.
Regarding the specific details of the incident, Binance spokesperson Ross O'Leary refused to further respond to the media's questions about employee terminal protection mechanisms, malicious code execution restrictions, and whether a third-party network security audit was conducted before the incident. He only stated that the company will invite external security experts to participate in the investigation and has deployed new protective measures to avoid similar incidents from happening again.
Currently, this $6.3 billion theft remains the largest theft in the history of cryptocurrency.
Comments