Binance Discloses Crypto Theft Attack Chain Involving Fake Interviews and Internal AI Tools
Enterprise AI
Binance released investigation details regarding a $6.34 billion crypto theft. Attackers used fake job interviews to trick an engineer into running malware, then leveraged internal AI tools to compromise colleagues' systems and container deployment tokens to access wallet signing services. Around $2.85 billion has been frozen or intercepted.
Cryptocurrency exchange Binance disclosed preliminary findings on a security incident resulting in the theft of approximately $6.34 billion in crypto assets. In September, attackers posed as hiring managers to lure an engineer into executing malicious interview assignment code, replacing pyenv binaries to gain access. On October 20, attackers used the compromised computer and internal AI tools to access additional wallet engineers' machines and locate container deployment credentials, subsequently deploying malicious containers to access wallet signing services on October 30. Binance stated that approximately $2.85 billion has been intercepted or frozen, and it has rebuilt affected wallet systems and internal AI tools while continuing its investigation.
Key takeaways
- Attackers disguised malware as a job interview coding assignment to compromise an engineer's pyenv setup.
- The breach leveraged the compromised system and Binance's internal AI tools to gain container deployment privileges.
- Stolen credentials allowed attackers to bypass normal withdrawal controls via the wallet signing service.
- Binance stated roughly $2.85 billion has been frozen or intercepted, pledged to cover losses, and rebuilt affected tools.
Source：iThome Read the original ↗
Prepared, checked and automatically published by AI; not individually reviewed by a human. Translation checked by AI.