Fake Interview of Software Engineer Led to Binance Mega-Heist
Binance revealed the news in a lengthy post on X (formerly Twitter) on November 3; read more on crypto theft: Hackers Exploit BTCPay Server Flaw to Steal Cryptocurrency.
Binance revealed the news in a lengthy post on X (formerly Twitter) on November 3; read more on crypto theft: Hackers Exploit BTCPay Server Flaw to Steal Cryptocurrency.
The main point of intrusion appears to have stemmed from an interview the threat group set up with an unnamed Software Engineer B in September.
After compromising Engineer A’s machine, they found out he had a container deployment permission token on his computer.
The first-round interview was held with a fictitious HR representative, during which the interviewer shared a social media account with the engineer, including personal photos and videos posted, to build trust, Binance said.
These included replacing a legitimate development tool component with a malicious version to execute commands and connect with a C2 server.
On October 20, the attacker accessed an internal AI tool via Engineer B’s computer to compromise the machines of two other Binance employees: Wallet DevOps Engineer A and Wallet Software Engineer C.
Although the Binance team at the time, the engineer’s role and those of his colleagues had already been exposed to the hackers.
An individual posing as a project director contacted the engineer via a legitimate job-hunting platform, having spotted from their profile that they worked at Binance.
According to Binance, the zero-day malware used obfuscation and evasion techniques to ensure it was not detected by the engineer’s endpoint security tools.
It is currently conducting a review of the incident, setting up a security research fund with industry partners, and has already increased investment in AI-enabled detection, protection and monitoring tools.
In a world where quiet quitting exists, it should come as no surprise that employees are interviewing on company time.
What happened
Binance revealed the news in a lengthy post on X (formerly Twitter) on November 3; read more on crypto theft: Hackers Exploit BTCPay Server Flaw to Steal Cryptocurrency.
The main point of intrusion appears to have stemmed from an interview the threat group set up with an unnamed Software Engineer B in September.
What changed
After compromising Engineer A’s machine, they found out he had a container deployment permission token on his computer.
Who is affected
The first-round interview was held with a fictitious HR representative, during which the interviewer shared a social media account with the engineer, including personal photos and videos posted, to build trust, Binance said.
These included replacing a legitimate development tool component with a malicious version to execute commands and connect with a C2 server.
Why it matters
On October 20, the attacker accessed an internal AI tool via Engineer B’s computer to compromise the machines of two other Binance employees: Wallet DevOps Engineer A and Wallet Software Engineer C.
Although the Binance team at the time, the engineer’s role and those of his colleagues had already been exposed to the hackers.
Technical details
An individual posing as a project director contacted the engineer via a legitimate job-hunting platform, having spotted from their profile that they worked at Binance.
According to Binance, the zero-day malware used obfuscation and evasion techniques to ensure it was not detected by the engineer’s endpoint security tools.
Response
It is currently conducting a review of the incident, setting up a security research fund with industry partners, and has already increased investment in AI-enabled detection, protection and monitoring tools.
What security teams should do
In a world where quiet quitting exists, it should come as no surprise that employees are interviewing on company time.
Attribution
Infosecurity Magazine: Binance revealed the news in a lengthy post on X (formerly Twitter) on November 3.