Dodgy download and spoofed job ad led to $6.3 billion Binance hack: attacker offered fake software and fake job to infiltrate company wallets and steal billions

A chain of events that led to a record-breaking $6.3 billion mega-hack began with a dodgy download, so says the company that was hacked, Binance.

The world’s largest cryptocurrency exchange says that the hack was not a “single isolated breach or simple phishing incident”; multiple steps were required to break through its security measures. It all began when a Wallet DevOps engineer (named Engineer A) downloaded a tampered Homebrew installation that was suggested to them by an unnamed search engine.

Homebrew is a third-party package manager for macOS. A report from the SANS Technology Institute, linked to in Binance’s investigation, suggests that malicious adverts for Homebrew have been spotted in search engine results, hoping to ensnare users into installing malware on a user’s PC.

“Our security team detected the anomaly, replaced the device, and rotated all related credentials as a proactive security action,” Binance says. “However, Engineer A’s role and his related colleagues on our wallet infrastructure team was exposed to the hacker.”

Then came a separate incident with a software engineer (named Engineer B). They were contacted through a job hunting platform (Binance says it was a legitimate platform) and was asked to attend a first-round interview with a HR representative. This was followed by up a second-round interview with the CEO. Not the HR representative, nor the CEO, however, were real; the company was made up.

The aim of the interviews? To offer Engineer B an ‘assignment’ that was really a repository of malicious code that executed during setup. The malware ran a series of commands and evasion techniques to avoid detection, thus avoiding Binance’s security checks.

The attacker used Engineer B’s now-compromised computer and an internal AI tool to gain control over two further machines: that of Engineer A and another Wallet Software engineer (Engineer C). They discovered a container deployment permission token on Engineer A’s machine. With this, they could log into Engineer C’s computer using the stolen credentials to create a container and trigger a malicious script to start the mega-hack that would drain $6.3 billion worth of funds from wallets used to store transitory funds by the exchange.

So, basically, the internet is a bad place, and you can’t trust anyone. Or, at least, you have to have your wits about you—especially if you happen to have the key to a multi-billion dollar company’s finances stored on your PC somewhere. Luckily, my PC is just pictures of my cat and a Steam backlog that won’t quit.

That’s actually some of the criticism levelled at the company. Should it have been possible to get this level of access even with spoofed ads and jobs?

Reminder that the FBI reckons a North Korean hacking group is behind the attack, which North Korean officials have unsurprisingly denied. Binance has frozen roughly half of the funds that were initially stolen, and has already covered the rest.