North Korea used LinkedIn, fake job interviews to trick Binance engineer in $6.3 billion hack

Binance on Tuesday disclosed that North Korean hackers used a mix of social engineering and malicious software to pull off last week’s $6.3 billion heist , the biggest in crypto history. Speaking to reporters, company executives revealed that the hackers targeted a Binance engineer on LinkedIn and arranged a series of fake job interviews in order to persuade the employee to download an “assignment” that let them invade the company’s systems. In a related report, Binance explained that: “Software Engineer B was contacted through a legitimate job-hunting platform by an individual posing as a Project Director. Software Engineer B had a profile on the platform that referenced his experience at Binance. The purported Project Director arranged a first-round interview with a HR representative, followed by a second-round interview with an individual claiming to be the CEO of a fictitious company.” The report also provided additional details about a sophisticated months-long scheme that involved not only the fake LinkedIn recruitment, but also used a separate ad campaign that earlier tricked another engineer into downloading a malicious version of a popular software package called Homebrew. According to Binance, the engineer in question did not download the Homebrew software though the company’s regular channels, but instead clicked on an internet ad promoting a tampered version of it. Binance says it detected the fake Homebrew download and removed it from the employee’s machine, but not before the hackers discovered critical information about the engineer’s role and others who managed the company’s wallets. It was the combination of these exploits—the fake LinkedIn outreach and the knowledge gleaned from the tampered Homebrew download—that allowed the North Korean hackers to take over a series of Binance wallets and drain them of funds. According to a Binance spokesperson, employees with non-public facing roles are not allowed to maintain LinkedIn profiles. The spokesperson declined to explain if the engineer in question had violated that policy, or if either of the engineers would be terminated.