North Korean cryptocurrency thieves tricked a Binance software engineer into downloading malware onto their work-issued computer during a fake job interview process before last week’s record-breaking $6.3 billion heist.
In an incident report published on Tuesday, the cryptocurrency exchange said several techniques - including social engineering via fake job interviews, malware downloads, compromised internal AI tooling, endpoint takeover, and an “advanced transaction-authorization method” - led to the October 29 security breach.
“Our current investigation indicates that this was a sophisticated, multi-stage campaign,” the incident report said. “It was not a single isolated breach or a simple phishing incident.”
Over the weekend, the FBI attributed the theft to TraderTraitor, a North Korean hacking operation linked to Lazarus Group, known for combining espionage with massive cryptocurrency heists. The Pyongyang-backed crew is also highly adept at job market scams - both posing as IT workers, who are then hired by Western companies, and as potential employers to lure software engineers into downloading malware and infecting corporate devices.
I work in HR. I am getting emails DAILY from data thieves pretending to be an actual employee asking I change their direct deposit account. Luckily I have access to each employee’s personal email info, so if what I get isn’t from their personal email I ignore it.
Stay vigilant out there. Well done.
Well, you just call to confirm. Like, yes, that address is fine, but any financial changes out to have a human confirmation process. A simple: did you…? Yes/no?
If they start spoofing, what’s the protocol?
Emails are nice because the messages often tack on routing, which is traceable so I hope you have a good IT team willing to filter.
If the email seems like it could be legit, I call the employee to confirm. We have a form the employee fills out to make the change that needs sensitive information, like their SSN and employee ID. For the stuff that’s obvious phishing I delete without responding.