// PC GAMER — GAMING
Dodgy download and spoofed job ad led to $6.3 billion Binance hack: attacker offered fake software and fake job to infiltrate company wallets and steal billions
I'm feeling fresh appreciation for my company's mandatory cybersecurity awareness course.
When you purchase through links on our site, we may earn an affiliate commission. Here’s how it works.
A chain of events that led to a record-breaking $6.3 billion mega-hack began with a dodgy download, so says the company that was hacked, Binance.
The world's largest cryptocurrency exchange says that the hack was not a "single isolated breach or simple phishing incident"; multiple steps were required to break through its security measures. It all began when a Wallet DevOps engineer (named Engineer A) downloaded a tampered Homebrew installation that was suggested to them by an unnamed search engine.
Homebrew is a third-party package manager for macOS. A report from the SANS Technology Institute, linked to in Binance's investigation, suggests that malicious adverts for Homebrew have been spotted in search engine results, hoping to ensnare users into installing malware on a user's PC.
"Our security team detected the anomaly, replaced the device, and rotated all related credentials as a proactive security action," Binance says. "However, Engineer A’s role and his related colleagues on our wallet infrastructure team was exposed to the hacker."
Then came a separate incident with a software engineer (named Engineer B). They were contacted through a job hunting platform (Binance says it was a legitimate platform) and was asked to attend a first-round interview with a HR representative. This was followed by up a second-round interview with the CEO. Not the HR representative, nor the CEO, however, were real; the company was made up.
The aim of the interviews? To offer Engineer B an 'assignment' that was really a repository of malicious code that executed during setup. The malware ran a series of commands and evasion techniques to avoid detection, thus avoiding Binance's security checks.
The attacker used Engineer B's now-compromised computer and an internal AI tool to gain control over two further machines: that of Engineer A and another Wallet Software engineer (Engineer C). They discovered a container deployment permission token on Engineer A's machine. With this, they could log into Engineer C's computer using the stolen credentials to create a container and trigger a malicious script to start the mega-hack that would drain $6.3 billion worth of funds from wallets used to store transitory funds by the exchange.
Keep up to date with the most important stories and the best deals, as picked by the PC Gamer team.