Binance has revealed more details about the cyber attack that resulted in a $6.34 billion loss in digital assets. The cryptocurrency exchange's statement linked to the FBI's findings that North Korea was responsible for the attack and the theft that took place on October 29. It also explained that it wasn't just a one-day operation for the attackers. In June, a Wallet DevOps engineer working on Binance's wallet infrastructure downloaded a tampered homebrew installation for a popular AI coding tool that he found through a search engine. Binance was able to detect the anomaly at the time and was able to take action, but the event exposed information on the engineers' colleagues to the attackers.

Then in September, a software engineer who worked for Binance got a message from a "Project Director" through a legitimate job-hunting platform. He went through two rounds of job interviews, the first of which was on live video with a supposed HR Representative who shared a personal social media account with him to build trust. His second interview was with the purported CEO of the fictitious company conducted through a chat app. The fake CEO sent him an assignment, which he downloaded. Turned out the file had malware in it that was executed during the setup process.

According to Binance, the malware "employed sophisticated obfuscation and evasion techniques" to escape detection. For instance, it replaced an authentic development tool component with a malicious version to execute commands. The malware also concealed its activities and removed traces of the compromise as it went along.

Source link