Similar to the incident involving the Indodax exchange in

Post

Similar to the incident involving the Indodax exchange in Indonesia, which was hacked in 2024.

The perpetrators’ modus operandi was to offer jobs to Indodax employees. Since the victim used a company laptop, the hack could be carried out. If I’m not mistaken, the losses amounted to around 300 billion rupiah.

An exchange that has been hacked isn’t necessarily a bad one. In fact, if it survives a hack and the resulting losses, that proves the company is resilient. Indodax is still operating to this day.

机灵的杰尼君

The preliminary report on the $6.3 billion theft from Binance @binancezh is out. Another social engineering infiltration.
It started when Engineer B used a company computer during a job interview after switching jobs—and even downloaded third-party code. How much more can they dock from his performance review? 🤡

How the theft happened:
In June, Wallet Operations Engineer A searched for an AI coding tool and downloaded a tampered version of Homebrew, exposing the team’s information;

In September, Engineer B was invited to an interview by a fake recruiter. They went through the whole routine: a real video call with HR, followed by a second interview with a fake CEO. Finally, they asked him to run a “coding challenge” on his work computer, and the malware secretly replaced pyenv;

On October 20, hackers used B’s computer as a starting point and leveraged Binance’s internal AI tools to take control of the computers belonging to Wallet Engineers A and C;

On October 29, the hackers accessed C’s computer and used A’s deployment permissions to make calls to the signing service. That’s how the hot-wallet funds were transferred out.

North Korean hackers really are everywhere.
From now on, when exchange employees go to interviews, should they first make the interviewer say, “Kim Jong-un is **”? 🤣