Targeted by Job Interview Ruse... How the 8 Trillion Won Hack Unfolded

[Anchor]

Cryptocurrency exchange Binance, which suffered a record-breaking hacking attack, has released an investigative report detailing how it was breached. It was revealed that North Korean hackers targeted exchange developers months in advance, infiltrating the system by posing as job interviewers to plant malicious code.

This report is by Hong Yeongjae.

[Reporter]

The attack by North Korean hackers, confirmed through Binance's internal investigation into the massive 8 trillion won security breach, was meticulously carried out in stages starting four months prior to the incident.

Back in June, North Korean hackers first stole personal information from Binance developers to scout potential targets.

Then in September, a job offer was sent to one of the developers via a recruitment platform.

An investigator formerly with the FBI who was interviewed by SBS analyzed that the hackers likely scouted their targets thoroughly in advance.

[Nick Carlsen / North Korea Investigation Expert at TRM Labs: The reason the hackers approached this developer is because they likely conducted a lot of prior research and already knew to some extent that the developer had access permissions to the system they were trying to reach.]

After building rapport with the developer by even sharing social media accounts, the North Korean hacker demanded that the developer download a program, claiming it was for a final interview test impersonating the CEO.

The program contained hidden malicious code.

Using the infected computer of the developer, the hackers roamed through the internal servers of the exchange and ultimately succeeded in the 8 trillion won hack.

[Moon Jong-hyun / Head of Genians Security Center: Binance likely did not have weak security. The most critical point is that this attack was launched through human targets. Current attackers, especially state-sponsored hacking groups including those from North Korea, along with many sophisticated hacking experts, are targeting people.]

Binance stated that it detected and blocked 57 cyberattacks suspected to be linked to North Korea this year alone, but it was helpless against the sophisticated infiltration tactics of North Korean hackers exploiting human trust and psychology.

(Video Shooting: Joo Yong-jin | Video Editing: Lee Seung-hee | Design: Park Tae-young)

※