Binance says hackers used fake job interviews and an internal AI tool to pull off the $6.3 billion heist

Binance, a cryptocurrency exchange, suffered a $6.3 billion heist, the largest crypto theft to date. The heist was carried out by a North Korean hacking unit, known as 'TraderTraitor', who used a combination of well-known hacking techniques over the course of a few months. The attackers started by serving a malicious Google ad to a Binance developer, which led to the installation of tampered software. The attackers then posed as a potential employer, conducting fake job interviews and gaining the trust of another developer, who was tricked into downloading a fake interview assignment that was actually malware. The malware used sophisticated obfuscation and evasion techniques, including replacing a legitimate development tool component with a malicious version, and was not detected by Binance's endpoint security protection tools. The attackers used Binance's internal AI tool to gain control over wallets for two employees, before logging in and transferring funds out of the wallets.