Researchers warned of North Korean hacking tactics years before record $6.3B Binance heist

Crypto giant Binance says North Korean hackers used fake social media profiles and the lure of a potential job offer as part of a months-long scheme aimed at tricking an employee into downloading malicious software onto their laptop. Researchers have repeatedly warned about long-running social engineering attacks that can go on for months. This latest attack allowed the hackers to patiently worm their way into Binance’s systems to steal a record $6.3 billion in crypto last week, the company has now confirmed. The hack, disclosed in an updated statement posted on X on Tuesday, prompted the world’s largest crypto exchange to suspend customer withdrawals across its network. The FBI and blockchain investigators have blamed North Korea for the heist. The country has been long accused of carrying out massive cryptocurrency thefts in recent years to fund its internationally sanctioned nuclear weapons program. In its latest statement, Binance said that North Korean hackers, posing as recruiters hiring for a job, contacted a software engineer who works on wallets at the company. Following two interviews with the purported company, the engineer was instructed to download an apparent coding assignment as part of the interview process. While Binance replaced that compromised engineer’s laptop, the hackers used the engineer’s stolen credentials to break into the computer of a third engineer, whose job allowed them access to systems capable of controlling billions of dollars in crypto. While the case exposes how North Korean hackers use social engineering, such as offers of employment, to trick employees into granting access to their systems, it’s ultimately the responsibility of the company to ensure its systems cannot run unauthorized or untrusted software that could cause a compromise.