False recruitment and malicious code. This is how Binance was attacked.

Binance, the world's largest cryptocurrency exchange, presented a preliminary report describing the circumstances of the cyberattack. The culmination of the several-month operation was the withdrawal of cryptocurrencies worth 6.3 billion dollars on October 29th. According to the company, it all started in June when one of the programmers on the team responsible for the wallets downloaded a fake tool that used artificial intelligence. Binance detected the threat, removed the application, and changed the login credentials. However, hackers may have previously gained access to the login data of this employee and other team members. Fictitious recruitment and malicious code The next stage of the attack occurred in September. The second programmer, looking for a new job, participated in a recruitment interview for a position he believed was real. During the virtual meeting, he spoke with someone claiming to be the CEO of a fictitious company. Then he downloaded a repository containing malicious code onto his computer. On October 20th, the attackers used the infected computer and an internal tool based on artificial intelligence to take control of the wallet programmer's system and the second programmer from that team. On October 29th, the attackers used the second programmer's computer, using the stolen login data of the first programmer, and launched a malicious script to carry out the attack. The FBI points to North Korea The FBI accused a North Korean hacking group of carrying out the cyberattack, but North Korea rejected these allegations. Binance stated that it would return the funds to all clients who lost money as a result of the attack. On Tuesday, the exchange announced that following the cyberattack, it will increase investments in artificial intelligence-based detection systems and is working on creating a fund for security research and targeted initiatives in cooperation with leading artificial intelligence companies.