'It was not a single isolated breach or a simple phishing incident,' exchange says

North Korean cryptocurrency thieves tricked a Binance software engineer into downloading malware onto their work-issued computer during a fake job interview process before last week’s record-breaking $6.3 billion heist.

In an incident report published on Tuesday, the cryptocurrency exchange said several techniques - including social engineering via fake job interviews, malware downloads, compromised internal AI tooling, endpoint takeover, and an “advanced transaction-authorization method” - led to the October 29 security breach.

“Our current investigation indicates that this was a sophisticated, multi-stage campaign,” the incident report said. “It was not a single isolated breach or a simple phishing incident.”

Over the weekend, the FBI attributed the theft to TraderTraitor, a North Korean hacking operation linked to Lazarus Group, known for combining espionage with massive cryptocurrency heists. The Pyongyang-backed crew is also highly adept at job market scams - both posing as IT workers, who are then hired by Western companies, and as potential employers to lure software engineers into downloading malware and infecting corporate devices.

  • RacerX@lemmy.zipEnglish
    3·
    10 days ago

    People scoff at the mandatory infosec training for SOC II and ISO 27001 compliance, then download garbage to their work computer and lose $6B.

  • Washedupcynic@lemmy.caEnglish
    1·
    9 days ago

    I work in HR. I am getting emails DAILY from data thieves pretending to be an actual employee asking I change their direct deposit account. Luckily I have access to each employee’s personal email info, so if what I get isn’t from their personal email I ignore it.

    • heartSagan5@lemmy.zipEnglish
      0·
      9 days ago

      Well, you just call to confirm. Like, yes, that address is fine, but any financial changes out to have a human confirmation process. A simple: did you…? Yes/no?

      If they start spoofing, what’s the protocol?

      Emails are nice because the messages often tack on routing, which is traceable so I hope you have a good IT team willing to filter.

      • Washedupcynic@lemmy.caEnglish
        0·
        9 days ago

        If the email seems like it could be legit, I call the employee to confirm. We have a form the employee fills out to make the change that needs sensitive information, like their SSN and employee ID. For the stuff that’s obvious phishing I delete without responding.

  • FlashMobOfOne@lemmy.worldOPEnglish
    1·
    10 days ago

    It appears the Binance hack was a social engineering stunt. Can’t say I’m surprised. Often the biggest weaknesses in any system is the people running it.

      • Aceticon@lemmy.dbzer0.comEnglish
        1·
        9 days ago

        A Finance company which has its production systems in the same network as worker computers which aren’t locked-down tight is basically amateur hour every hour of the day every day of the month every month of the year.

        You can never assume that workers won’t do stupid shit like downloading random software into their work computers even when its a fuckingly obvious bad idea for most people to do such stupid shit - it only takes one idiot, naive fool or even momentary distraction of somebody who should’ve known better to end up with your network hacked, so you always treat such devices as possibly contaminated.

    • Denvil@piefed.worldEnglish
      1·
      10 days ago

      I like how companies always emphasize how advanced and sophisticated the attack was, and it just boils down to somebody downloading something

  • Buffalox@lemmy.worldEnglish
    1·
    10 days ago

    At least nothing of any real value was lost. Bitcoins are not really better than NFT, and those are worthless today. It’s just that bitcoin can be used for illegal activities, otherwise they have no use, but that’s apparently enough for some people to still believe they are worth something.