Key facts
- Binance's preliminary investigation said a September fake-interview coding assignment became part of the attack chain.
- Su said each step of such an assessment can look legitimate, so antivirus tools may not flag it.
- Binance said its endpoint security tools were evaded through obfuscation and other techniques.
- Su said the onus is on Binance to detect a fake interview and stop the code from executing.
- Binance said it blocked 57 suspected North Korea-linked cyber threats so far this year.
- Binance said it tightened device controls, rebuilt affected wallet systems and revoked compromised credentials after the attack.
Binance chief security officer Jimmy Su described in a July interview with Cointelegraph how a fake job interview could give attackers a foothold inside the exchange, a method Binance's preliminary investigation later linked to the October theft of $6.3 billion.
Su said fake job interviews were "something we worry about a lot internally." Attackers could tailor a job opportunity to an employee and then persuade them to run code as part of a technical assessment, he said. "And once that gets executed, the device is compromised and then they can start harvesting credentials," Su said, adding that attackers could then move further into the network.
Su also said such a trap could evade security tools because each step looks legitimate, such as downloading a code repository from GitHub. "Each step is actually legitimate on its own. So a lot of the anti-virus tools may not be able to detect it and flag it," he said. Binance's investigation described a similar detection failure, saying the assignment's setup process executed malware that evaded endpoint security tools through obfuscation and other techniques.
According to Binance's preliminary investigation, a Binance software engineer downloaded a malicious coding assignment onto his work computer during a fake job interview in September, and that compromise became part of the multistage attack that ended in October's theft.
Su said employees may explore outside opportunities but that doing so on a company device is the concern. If an employee fell for a fake interview, he said, "the onus is on us to detect it" and to "stop the actual execution of that code." He said Binance's internal red team had run monthly phishing simulations for three to four years, with remedial training for employees who failed.