Home / Business and Economy / Human Error Fueled $6.3B Crypto Heist: Binance Investigation
Human Error Fueled $6.3B Crypto Heist: Binance Investigation
3 Nov
Summary
- Attackers used fake job interviews to trick an engineer.
- Malicious code was downloaded via a tampered software assignment.
- Human error allowed hackers access to Binance's AI tools.
An internal investigation by Binance has detailed how human error facilitated the massive $6.3 billion crypto theft, the largest in history. Attackers employed a multi-faceted approach, combining fake recruitment interviews with malicious software downloads.
One Binance engineer downloaded tampered software in June, which was detected and the engineer's device replaced. However, this exposure allowed attackers access to the engineer's colleagues on the wallet infrastructure team.
In September, a second engineer was targeted via a job-hunting platform. After a series of deceptive virtual interviews, the engineer was instructed to download an interview assignment containing malicious code. This malware, designed to evade detection, was used to compromise Binance's internal AI tools.
The attackers leveraged the compromised engineer's laptop and the AI tools to gain control of other engineers' laptops. On October 29, they used a malicious script on a third engineer's device to execute the theft.
Binance has since rebuilt its wallet systems and AI tools, reinforcing security with external experts. The company stated it has sufficient funds to cover user losses and has restored withdrawal capabilities. Some security measures will remain confidential to prevent future attacks.
