North Korean fake job interview led to $6.3B Binance heist

Key Points:

• North Korean hackers linked to the Lazarus Group executed a sophisticated, multi-stage attack on Binance, involving social engineering through fake job interviews that led a software engineer to download malware onto his work computer.
• The attack began in June with a supply chain compromise, followed by a deceptive job interview process in September, where the engineer was tricked into installing malware disguised as a legitimate development tool.
• The malware replaced a legitimate pyenv tool with a malicious version, allowing attackers to execute commands, communicate with external servers, and evade detection by Binance’s security systems.
• Using the compromised engineer's credentials and internal AI tools, the hackers accessed other engineers' devices and deployed a container that launched the $6.3 billion cryptocurrency theft on October 29.
• Binance has since rebuilt affected systems, replaced devices, revoked credentials, and is collaborating with law enforcement and cybersecurity experts while planning new AI-focused security initiatives to prevent future incidents.