Binance was hacked starting from a fake recruitment, with methods similar to the Axie case

The preliminary investigation report on the security incident released by Binance on October 29 shows that the attack began with a fake recruitment. According to the report, in September, a Binance software engineer was contacted by someone impersonating a project director through a legitimate job platform. After undergoing a fake HR video interview and a fake CEO second interview, the engineer was asked to download a homework code repository on their work computer, which contained a zero-day Trojan that bypassed endpoint protection. The attackers then used the compromised device and an internal AI tool to control the computers of two other wallet engineers, stealing deployment credentials, and ultimately executed a malicious script on October 29 to transfer approximately $6.3 billion. Binance stated that it has frozen or intercepted about $2.85 billion and has compensated 98% of the affected assets.

This method is almost identical to the March 2022 theft of the Axie Infinity sidechain Ronin cross-chain bridge. At that time, the North Korean hacker group Lazarus contacted a senior engineer at developer Sky Mavis through LinkedIn for a high-paying position. After several rounds of interviews, they sent an offer file containing a Trojan, which allowed them to control the private keys of the validation nodes, stealing approximately $625 million. The Binance report also noted that this year, 57 suspected cyberattacks related to North Korea have been detected and intercepted, with methods including fake interviews, malware disguised as popular development tools, tampered software packages, and browser plugins, among others.