Binance says fake hiring process paved the way for multibillion-dollar theft; experts explain the lure
According to the exchange, an engineer ran malicious code during a fraudulent selection process; experts interviewed by g1 say job openings and technical tests have become a gateway for hackers.
Translated from the Portuguese original by the Panorama newsroom. Read in Portuguese
Summary written by the Panorama newsroom from the sources listed below. Facts are attributed to the original publications.
A fake job offer was at the origin of the theft of US$6.3 billion (about R$34 billion) from Binance, the world's largest cryptocurrency exchange, according to the company itself, g1 reports. An employee downloaded malicious files onto a corporate computer during a hiring process he believed was legitimate.
According to Binance, the operation was planned over months. In June, a member of the digital wallets team downloaded a tampered artificial intelligence tool; the company replaced the device and changed credentials, but the intruders had already gathered information about the team. In September, a second software engineer took part in a fake selection process, which even included a virtual meeting with a supposed CEO, and downloaded a malicious code repository onto his work machine.
Also according to the company, on October 20 the criminals used that device and an internal AI tool to take control of two developers' systems; the theft took place on October 29. The FBI attributed the attack to a hacker group linked to North Korea, which denies involvement.
For Hiago Kim, president of the Brazilian Cybersecurity Association, the case is an example of social engineering: scammers create fake recruiter profiles, especially on LinkedIn, and request technical tests, such as spreadsheets, programs or files, which, when run, can open a secret connection to the hackers. One variation is fake freelance work offered on forums and in Telegram and Discord groups.
Kim believes the central flaw is the excess of privileges granted to certain accounts and asks why a single compromised account could cause a loss of that size. Experts interviewed by g1 also stress that holding employees who fall for the scam liable is not automatic: penalties require the intentional breach of security rules the worker knew about.