Fell for 'Job Interview' Trap... Inside Look at How the 8 Trillion Won Hack Unfolded

[Anchor]

Binance, the cryptocurrency exchange that suffered a record-breaking hack, has released an investigative report detailing how it was attacked. It has been revealed that North Korean hackers targeted the exchange's developers months in advance, infiltrating the system by posing as a job interview to plant malicious code.

Here is a report by Hong Yeongjae.

[Reporter]

The attack by North Korean hackers, confirmed through Binance's internal investigation into the massive hacking incident causing damages worth around 8 trillion won, was carried out in meticulous stages starting four months prior to the incident.

Back in June, North Korean hackers first stole personal information from Binance developers to scout out targets for the attack.

Then, in September, a job offer came through a recruitment platform to one of the developers.

An investigator formerly with the FBI who was interviewed by SBS analyzed that the hackers likely scouted their targets meticulously in advance.

[Nick Carlsen / North Korea Specialist Investigator at TRM Labs : The reason the hackers approached this developer is because they likely did a lot of research beforehand and already knew to some extent that the developer had access rights to the system they were trying to reach.]

After building rapport with the developer by even sharing social media accounts, the North Korean hacker demanded that the developer download a program, claiming it was for a test required during the final interview while impersonating the CEO.

Malicious code was hidden inside the program.

Using the infected developer's computer, the hackers roamed through the exchange's internal servers, ultimately succeeding in the 8 trillion won hack.

[Moon Jong-hyun / Head of Genians Security Center : Binance probably didn't have weak security. The most core point is that this attack is going through people. Attackers today—especially advanced hacking organizations including North Korea and many others—are targeting people.]

Binance stated that it detected and blocked 57 cyberattacks suspected to be linked to North Korea this year alone, but it was helpless against the sophisticated infiltration tactics of North Korean hackers who exploit human trust and psychology.

(Video Shooting: Joo Yong-jin, Video Editing: Lee Seung-hee, Design: Park Tae-young)
※ Please note: This article was translated by AI and may contain errors.