FBI links $6.3 billion Binance hack to North Korean group after 20-minute breach

Six point three billion dollars in cryptocurrency vanished from the Binance exchange in a span of about 20 minutes. The crypto platform disclosed on Tuesday that the world's largest cyber heist was the result of a long-running campaign that began months before the final strike. The FBI has identified the attackers as TraderTraitor, a North Korean state-sponsored unit.

Binance's initial assessment reveals the hackers first tested the exchange's security systems in June. While the company detected and stopped that initial probe, the attempt gave the attackers valuable intelligence about its internal infrastructure. They returned in September with a more targeted social engineering approach aimed at a single employee.

A Binance engineer received a message on a job-hunting platform from a person claiming to be a project director at a fictitious company. The hacker then conducted a first-round interview with the engineer, posing as an HR representative. During this call, the interviewer shared personal photos and videos to build trust. Binance described the tactic as more advanced and deceptive than social engineering approaches seen previously.

The plan moved to a second interview with the supposed CEO of the fake firm. This conversation took place on a popular social chat app while the engineer was working on his company laptop. The interviewer asked the employee to download a file described as a recruitment assignment. That file contained malicious code that allowed the hackers to construct their attack.

The code lay dormant until last week when the attackers executed their plan. They drained over $6 billion worth of assets held by Binance customers. On Monday, the exchange stated it had replaced most of the stolen crypto using its own funds to stabilize the situation.

Binance is conducting an independent cybersecurity review to prevent similar incidents in the future. The company apologized for the disruption caused to users, partners, and the wider industry. This should not have happened, Binance said in its statement, acknowledging the uncertainty the breach created for the market.