In the long history of people trying to take what others have built, the newest door to fall open was not a vault or a password but a hope: the hope of being hired. A Binance engineer, reaching for an ordinary career opportunity, was drawn into a patient deception that, according to the exchange, ended in the largest theft the crypto world has ever seen, roughly $9 billion taken over four hours in late October. The FBI has pointed toward North Korea-affiliated hackers, a claim Pyongyang rejects, and the truth of who held the keys will be settled over time. For now, the story is a reminder that
Binance says fake job interviews and malicious code enabled $9B crypto heist, with 98% of assets recovered
The company did not exist.
Mark
Why does this story land differently from other crypto thefts?
Mimi
Because of how it began. Nobody broke through a wall. An engineer was offered a job interview and asked to download a test. Trust was the entry point.
Mark
And it took months, didn't it?
Mimi
Binance says the planning started as early as June, with a poisoned version of Homebrew aimed at one engineer. That was caught, but the hackers had already gathered information on him and his colleagues.
Luke
Worth saying who is speaking, though. The timeline comes from Binance. It's the company describing its own breach, and no independent account is cited.
Mark
The FBI has pointed to North Korea, correct?
Mimi
Yes, the FBI attributed the four-hour attack on October 29 to North Korea-affiliated hackers. Pyongyang denies it, and Kim Jong Un's sister called the claim "absurd rhetoric".
Luke
So that's an attribution and a denial. What we have is the FBI's claim, not a public evidentiary case.
Mark
What about the 98 per cent recovery figure?
Mimi
Binance says it replenished that share of affected assets from its own funds. That's different from getting the stolen money back.
Luke
Exactly. The recovered money is Binance's own. Only about a third of the stolen assets are frozen, and whether they come back is unknown.
The Pulse
- A routine-looking job interview became the entry point for a theft of $US6.6 billion in roughly four hours.
- Malware hidden in a test exercise slipped past defenses and opened a path into Binance's internal systems.
- Binance says it has replenished 98 per cent of the affected assets from its own funds, steadying a shaken market.
- About a third of the stolen funds are frozen, and the open question is whether they can be won back.
In the long history of people trying to take what others have built, the newest door to fall open was not a vault or a password but a hope: the hope of being hired. A Binance engineer, reaching for an ordinary career opportunity, was drawn into a patient deception that, according to the exchange, ended in the largest theft the crypto world has ever seen, roughly $9 billion taken over four hours in late October. The FBI has pointed toward North Korea-affiliated hackers, a claim Pyongyang rejects, and the truth of who held the keys will be settled over time. For now, the story is a reminder that the weakest point in a fortress is often the trusting person standing inside it.
In September, an engineer at Binance received what seemed like an ordinary invitation: an interview for a job at another company, reached through a legitimate job-search platform. The company did not exist. According to Binance, the people behind the approach spent time building trust, exchanging photos and videos drawn from social media, before asking him to download a test exercise. That download, the exchange says, opened the door to the largest cyber attack in the history of the cryptocurrency sector.
The attack lasted four hours on October 29 and sent most major cryptocurrency prices sharply lower. Binance says the planning went back as far as June, when a platform engineer was tricked into installing a virus-laden version of a common programming tool. Binance's security teams caught and removed that malware, but the attackers had already gathered information about the engineer and his colleagues.
The September test exercise was the more consequential step. Binance says it hid sophisticated concealment techniques, including a swapped-in malicious version of a legitimate development component, which gave the hackers a connection into the company's internal systems. On October 20 they used that foothold, along with an internal AI tool, to seize control of software used by two other engineers. Nine days later they set off the code that launched the attack.
Binance says the damage has largely been repaired, with 98 per cent of affected assets replenished from its own funds, and that about a third of the stolen assets are frozen and cannot be spent or converted. The FBI attributes the attack to North Korea-affiliated hackers, a charge Pyongyang denies. What remains is whether the frozen funds can be recovered, and whether an attack that began with a fake job offer will reshape crypto security or leave a lasting mark on prices.
In September, an engineer at Binance received an offer that looked routine: an interview for a job at another company, reached through a legitimate job-search platform. The company did not exist. According to Binance, the people behind the approach spent time building trust, sharing photos and videos from social media, before asking him to download a test exercise as part of the interview. That download, the exchange says, was the key that opened the door to the largest cyber attack in the history of the cryptocurrency sector.
Binance, the world's largest crypto-exchange platform, has now set out how $US6.6 billion ($9 billion) in funds was stolen. The attack lasted four hours on October 29 and caused the prices of most major cryptocurrencies to fall sharply. The FBI has attributed it to North Korea-affiliated hackers. North Korea has denied the allegation, and the powerful sister of leader Kim Jong Un called the claim "absurd rhetoric".
Binance says the planning began as early as June. The first target was a platform engineer, whom the hackers got to download a virus-laden version of Homebrew, widely known programming software. Binance's cybersecurity teams spotted the malware and removed it. But by then the attackers had had time to harvest information about the engineer and his colleagues.
The September approach to the second engineer was the more consequential step. The test exercise he was asked to complete contained malware that, Binance said, used "sophisticated obfuscation and evasion techniques". Among them was the replacement of a legitimate component of a development tool with a malicious version. Binance describes that malware as critical to the attack's success, because it let the hackers establish a connection into the company's internal systems.
On October 20, the attackers used that foothold, together with an internal AI tool, to take control of software used by two other engineers. Nine days later, on October 29, they triggered the malicious code that launched the attack.
The financial damage, by Binance's account, has largely been repaired. The company says 98 per cent of the affected assets have been replenished from its own funds. The remainder involves little-traded currencies that are harder to acquire. It also says around one-third of the stolen assets have been frozen, meaning the attackers cannot use them or convert them into another currency.
What to watch now is whether that frozen third can be recovered, and whether an attack that began with a fake job offer prompts wider changes in crypto security or leaves a lasting mark on prices. The account of how it unfolded comes from Binance itself, and the North Korea attribution comes from the FBI, which Pyongyang rejects.
Notable Quotes
The claim is "absurd rhetoric".— Kim Jong Un's sister, responding to the North Korea allegation
The malware used "sophisticated obfuscation and evasion techniques".— Binance
Want the full story?
Read the original at ABC News & Headlines – Australian Broadcasting Corporation ↗