Binance Reveals AI Tool and Fake Interviews Used in $6.3 Billion Heist by North Korean Hackers

Cryptocurrency exchange Binance has disclosed that a sophisticated attack, resulting in a massive $6.3 billion breach, involved fake job interviews and an internal AI tool. According to a post by Binance on Tuesday, the perpetrators exploited the compromised computer of one of its engineers. They then utilized an AI tool to gain unauthorized access to the wallets of two other engineers.

Binance detailed that this compromised system was used as a "springboard" on October 20. The attackers employed a combination of tactics, including social engineering through deceptive recruitment interviews, the deployment of malicious software, the misuse of compromised internal AI tooling, endpoint compromise, and an advanced transaction authorization method.

In response to the incident, Binance has implemented protective measures. These include rebuilding the affected wallet system in a new, secure environment, overhauling internal AI tools, and strengthening access controls. Additionally, the company has replaced compromised devices and decommissioned credentials and tokens associated with the affected engineers.

Previously, Binance had stated its intention to absorb the financial impact of the stolen funds, assuring customers that they would not bear the losses. The FBI, on Saturday, attributed the attack to TraderTraitor, a hacking group linked to the North Korean state. The FBI's statement indicated that law enforcement observed members of the group converting the stolen assets into ether and anticipates further laundering activities through related technologies.