Binance's theft method is nearly identical to the 2022 Axie hack, both starting with fake recruitment

According to 深潮 TechFlow, on November 4, Binance's preliminary investigation report on the October 29 security incident showed that the attack began with a fake recruitment.

According to the report, in September, a Binance software engineer was contacted through a legitimate job platform by someone posing as a 'Project Director'. After a fake HR video interview and a second-round interview with a fake 'CEO', the engineer was asked to download a 'homework' code repository on their work computer, which contained a zero-day trojan that bypassed endpoint protection. The attackers then used the compromised device and an internal AI tool to take control of the computers of two other wallet engineers, stole deployment credentials, and ultimately ran a malicious script on October 29 to transfer approximately $6.3 billion. Binance said it has frozen or intercepted approximately $2.85 billion and replenished 98% of the affected assets.

This method was almost identical to the March 2022 theft from the Ronin cross-chain bridge, the sidechain of Axie Infinity. At the time, the North Korean hacking group Lazarus contacted a senior engineer at developer Sky Mavis on LinkedIn with a high-paying job offer, and after multiple 'interviews' sent a trojan-infected offer file, then gained control of validator node private keys and stole approximately $625 million.

Binance's report also said that so far this year, it has detected and intercepted 57 suspected North Korea-related cyberattacks, using methods including fake interviews, malware disguised as popular developer tools, tampered software packages, and browser extensions.

Source: 深潮 TechFlow