Report: Binance Hack Began With a Fake Job Recruitment, Method Closely Resembles 2022 Axie Theft

November 4 — Citing The Block: The preliminary investigation report on Binance's October 29 security incident shows that the theft of approximately $6.3 billion began with a fake recruitment. In September, a Binance software engineer was contacted through a legitimate job platform by someone impersonating a "project director." After a fake HR video interview and a fake "CEO" second-round interview, the engineer was asked to download a "homework" code repository onto a work computer; a zero-day trojan in it bypassed endpoint protection. The attackers then used the compromised device and internal AI tools to take control of two other wallet engineers' computers, steal deployment credentials, and ultimately run a malicious script on October 29 to move funds. Binance says it has frozen or blocked about $2.85 billion and has covered 98% of affected assets.

The report notes that this method is highly similar to the March 2022 theft at Ronin, the cross-chain bridge of the Axie Infinity sidechain. At the time, the North Korea-linked Lazarus Group approached a senior engineer at Sky Mavis via LinkedIn with a high-paying job offer, and after multiple rounds of interviews sent an offer file containing a trojan, thereby gaining control of validator node private keys and stealing about $625 million. Binance also said that since the start of this year it has detected and blocked 57 suspected North Korea-linked cyberattacks, with methods including fake interviews, malware disguised as development tools, tampered software packages and browser plug-ins.