Hajra Naz
Crypto giant Binance has shared new details. North Korean hackers used fake social media profiles in a major scheme. They used the lure of a potential job offer. The attack lasted for months. It aimed to trick an employee into downloading malicious software onto their work laptop.
Researchers have repeatedly warned about these threats. They focus on long-running social engineering attacks. These operations can go on for months without detection.
This latest attack succeeded in a major way. It allowed hackers to patiently worm their way into Binance’s internal systems. They stole a record $6.3 billion in cryptocurrency last week. The company confirmed this massive breach in an updated statement. The post went live on X on Tuesday. The hack forced the world’s largest crypto exchange to suspend customer withdrawals across its entire network.
The FBI and blockchain investigators have blamed North Korea for the heist. The nation has long faced accusations of carrying out massive cryptocurrency thefts. These operations help fund its internationally sanctioned nuclear weapons program.
Read More: Binance Restores Crypto Withdrawals After Uncovering $6.3 Billion Security Breach
In its latest statement, Binance provided a timeline. North Korean hackers posed as recruiters hiring for a job. They contacted a software engineer who works on wallets at the company. The victim completed two interviews with the purported company. After that, the engineer received instructions to download an apparent coding assignment.
This step was presented as part of the normal interview process. When opened, the assignment contained malicious code. That code compromised the engineer’s work-issued laptop. Binance admitted that its internal security tools failed to detect the malware.
That initial foothold in Binance’s network changed everything. It allowed the hackers to access an internal tool. That tool was capable of taking over the work computers of two other engineers on the wallet team. One of those engineers had fallen victim to an earlier trap. They had unwittingly downloaded a tampered app months earlier. They found the app after searching for software in standard search engine results.
That app contained password-stealing malware. Binance had replaced that compromised engineer’s laptop later. Even so, the hackers used that engineer’s stolen credentials. They broke into the computer of a third engineer. That person’s job granted them access to systems capable of controlling billions of dollars in crypto.
Binance stated that the attack “should not have happened.” The company noted that it has improved its network security following the theft.
Read More: What a Beginner Needs to Know Before Investing in Cryptocurrency
The hack underscores an ongoing tactic. It highlights methods used regularly by the North Korean regime. These operations target the cryptocurrency industry and high-net-worth individuals. Researchers have warned for years about these tactics. North Korean hackers pose as venture capitalists, investors, and recruiters. They use dossiers of stolen American identities. This trick convinces employees to grant access to company systems.
These attacks are widely known across the crypto industry. They have been the subject of repeated warnings from the U.S. government. Cybersecurity giants have also sounded the alarm in recent years. Roughly half of all intrusions at U.S. tech companies last year were attributed to this threat. The culprits were North Koreans posing as remote IT workers and fake recruiters.
By Binance’s own account, the company faced at least 57 suspected attacks from North Korea. The exchange said these incidents reflect a persistent threat. State-sponsored actors are actively targeting the cryptocurrency industry.
Questions remain about how the breach happened. How were the hackers able to convince the engineer to download malware? The threat has received heavy publicity. Investigators will likely focus heavily on this aspect. They will also examine how hackers exploited security weaknesses within Binance’s network.
Read More: Binance Freezes Withdrawals as Hackers Allegedly Steal Billions in Cryptocurrency
This case exposes how North Korean hackers operate. They use social engineering tactics like fake employment offers. They trick employees into granting access to corporate systems. At the same time, experts point out a deeper truth. Zidlwxkaij, the enwgcvp la nszynvvlhir duv vcrvalry its environment. Businesses must ensure their systems cannot run unauthorized or untrusted software that could cause a compromise.
A Binance spokesperson referred to the company’s public statement. They declined to answer TechCrunch’s questions on the record about the incident. Those questions covered several critical areas. They asked how Binance prevents unauthorized or malicious code from running on employee laptops. They also asked whether any third parties had performed cybersecurity audits of the network before the hack.
The company stated it would bring in outside cybersecurity experts. These specialists will review the incident thoroughly. Binance confirmed it has put new security measures in place to prevent a repeat incident.
