Fake hiring inquiries, a zero‑day flaw, and a months‑long premeditated attack: how Binance’s hackers pulled it off

On October 29, just over $6 billion in assets were stolen by hackers who managed to compromise the cryptocurrency giant Binance platform. But how did this happen? The story is as improbable as it is sophisticated, and it could not count on a departing employee.

The hackers “spent months preparing for their intrusion,” Richard Teng, co-CEO of the company, reveals to CNBC. “In June, they set up a fake version of a development tool and tricked one of our engineers into installing it,” he said. Fake job interviews and a zero-day flaw So, at the time, a Binance Wallet DevOps engineer downloaded fake software "to install a popular AI programming tool, after searching for it on a search engine."

A security report released by the company indicates the developer nevertheless became aware of suspicious activity and returned their device, changing their credentials as a precaution. But, according to Binance, "the employee's role and that of his colleagues within our team responsible for the infrastructure of our wallet had been exposed to the hacker". In September, everything accelerates.

The hackers pose as headhunters, using a known recruitment platform, and conduct a series of job interviews with a second engineer interested in a job that ultimately did not exist. They give him two interviews. The first took place with a supposed human resources representative of the company.

To gain confidence, this person went so far as to show photos published on fake personal accounts on social networks. The second interview took place with a person presenting himself as the general director of the structure. It is at the end of this discussion that the hackers ask the employee to download a file, which is supposed to be an exercise to judge their abilities.

The engineer then downloads it to his work machine provided by Binance. This file will, of course, compromise the computer. Here again, the pirates did things well.

“The malware employed sophisticated obfuscation and evasion techniques, including replacing a component of a legitimate development tool with a malicious version in order to execute commands and establish communication with an external server controlled by the attacker,” explains the Binance report. “From there, they quickly wandered through our internal AI tools and gained access that violated the system authorizing transactions,” adds Richard Teng. Another detail proves the extreme seriousness of these pirates and the means at their disposal.

The malware used was based on a "zero-day flaw", which was therefore "not detected by terminal protection tools". However, zero-day vulnerabilities are quite rare and therefore require resources, either to find them or to pay for them. Finally, the report announces that the attacker "also took steps to conceal its malicious activities and erase traces of the compromise, making its detection and subsequent investigation more difficult."

Machine-translated from French