Binance says the attack started with a fake recruiter. (Romain Doucelin/NurPhoto/picture alliance)
The biggest crypto heist on record didn't start with a clever piece of code. It started with a job interview.
North Korean hackers posed as recruiters, interviewed an engineer at Binance, the world's largest crypto exchange, and talked him into downloading a coding "assignment" that opened its systems, the company said in a report on Tuesday. They approached him on LinkedIn, according to Fortune.
"This should not have happened," Binance said, apologizing to users for the disruption.
How they got in: the first break came in June. An employee downloaded a tampered installer while setting up an AI coding tool. Binance caught it, replaced the laptop and changed his passwords, but the intruders had already learned who worked on its wallets.
The interview: in September, a fake recruiter contacted a different engineer. He sat two interviews, one with the supposed chief executive of a company that didn't exist. The final step was an assignment to download. It ran on his work computer and slipped past Binance's security software, Nextgov reported.
The theft: in late October, the attackers used that computer, and an internal Binance AI tool, to take over the machines of two engineers who run its wallets. Nine days later, they used one engineer's login on the other's computer to reach the system that approves transfers, skipping the normal withdrawal checks.
They moved about 233 million XRP tokens out of five wallets in four minutes, then bitcoin and other coins. The last transfer went out nearly four hours after the attack began.
Who pays: Binance says customers won't lose out. It has now replaced 98% of the stolen assets, up from the 95% it reported on Sunday. Nearly $2.9 billion of the stolen funds has been frozen or intercepted.
The North Korea link: the FBI blamed North Korea over the weekend and asked crypto firms to block any transactions touching the stolen money. Pyongyang denied it. US intelligence estimates North Korea makes at least $1 billion a year from crypto theft and other financial crime.
It's not the first try. Binance says it stopped 57 suspected North Korea-linked attacks this year.
Why it matters: the weak point wasn't the exchange's code, it was its people. Any company with staff on LinkedIn faces the same risk, and fake recruiters are now a favorite way in.
The Saudi angle: Saudi traders who use Binance still have no local regulator to call. Crypto isn't recognized in the kingdom, and Binance is licensed in Abu Dhabi.
What to watch: where the money goes next. Jonathan Levin, chief executive of blockchain analytics firm Chainalysis, expects it to move through bridges and instant swap services, the usual laundering routes.
For more on what the hack means for Saudi traders, read Binance Hack Leaves Saudi Traders With No Regulator to Call.
