Binance says hackers used fake job interviews and an internal AI tool to pull off the $6.3 billion heist

币安表示，黑客利用虚假求职面试和内部人工智能工具实施了 63 亿美元的盗窃案。

The largest crypto theft to date was pulled off by combining some well-known hacking techniques over the course of a few months, according to Binance. A postmortem from the company says the process started in June with one developer downloading a tampered installer apparently spread by a malicious Google ad, exposing details about the engineers and how they work. Then, in September, another engineer was targeted by someone pretending to be interested in hiring them; that person set up a series of calls and multiple rounds of interviews, shared social media pages to build trust, and eventually prompted them to download a fake interview assignment that was actually malware.

据币安称，这起迄今为止规模最大的加密货币盗窃案是在几个月的时间里，通过结合一些众所周知的黑客技术实施的。该公司的事后调查报告显示，这一过程始于 6 月份，当时一名开发人员下载了一个显然是通过恶意谷歌广告传播的篡改安装程序，从而泄露了有关工程师及其工作方式的细节。随后，在 9 月份，另一名工程师成为了目标，对方假装有兴趣聘用他；此人安排了一系列通话和多轮面试，分享了社交媒体页面以建立信任，并最终诱导该工程师下载了一份实际上是恶意软件的虚假面试作业。

Binance claims that its security teams did detect the first installation of malware in June, and replaced the worker’s device, but that its security tools didn’t detect the second attack that deleted the pyenv executable and replaced it with a malicious version that gave them backdoor access: The malware employed sophisticated obfuscation and evasion techniques, including replacing a legitimate development tool component with a malicious version to execute commands and establish communication with an attacker-controlled external server. The 0-day malware was not detected by the endpoint security protection tools at the time. The attacker also took steps to conceal the malicious activity and remove traces of the compromise, making detection and subsequent investigation more challenging.

币安声称，其安全团队确实在 6 月份检测到了第一次恶意软件安装，并更换了该员工的设备，但其安全工具未能检测到第二次攻击。第二次攻击删除了 pyenv 可执行文件，并将其替换为恶意版本，从而使攻击者获得了后门访问权限：该恶意软件采用了复杂的混淆和规避技术，包括用恶意版本替换合法的开发工具组件，以执行命令并与攻击者控制的外部服务器建立通信。当时，端点安全保护工具并未检测到这种零日漏洞恶意软件。攻击者还采取了措施来掩盖恶意活动并清除入侵痕迹，这使得检测和后续调查变得更加困难。

By October 20th, the story goes, the attackers, whom the FBI has identified as a North Korean unit dubbed “TraderTraitor,” used Binance’s own internal AI tool to gain control over wallets for the first engineer compromised in June, as well as a third employee, before logging into the third employee’s computer on October 29th and launching their attack.

据称，到 10 月 20 日，被联邦调查局（FBI）确认为名为“TraderTraitor”的朝鲜黑客组织的攻击者，利用币安内部的人工智能工具，控制了 6 月份受影响的第一位工程师以及第三位员工的钱包，随后于 10 月 29 日登录了第三位员工的电脑并实施了攻击。

The postmortem also goes into why Binance wasn’t able to stop the transactions that occurred nearly two hours after the first unauthorized transfers, saying that “Because the hot wallet used Multi-Party Computation (MPC), there was no single private key that could be used to immediately revoke the malicious EIP-7702 authorizations.” Binance says that it has prevented 57 suspected North Korea-linked cyber threat cases, and CEO Richard Teng writes that no user is bearing the loss, with about $2.85 billion in stolen assets frozen or intercepted: “At this moment, 98% of impacted tokens had been replenished; we’re completing the remaining 2%. Withdrawals have broadly resumed.”

事后调查报告还解释了为什么币安无法阻止在首次未经授权的转账发生近两小时后进行的交易，称“由于热钱包使用了多方计算（MPC），没有单一的私钥可以用来立即撤销恶意的 EIP-7702 授权。”币安表示，已阻止了 57 起涉嫌与朝鲜有关的网络威胁案件，首席执行官理查德·滕（Richard Teng）写道，没有用户承担损失，约 28.5 亿美元的被盗资产已被冻结或拦截：“目前，98% 的受影响代币已得到补充；我们正在完成剩余 2% 的补充工作。提现业务已全面恢复。”

What’s less clear is why this particular attack worked — the danger of job interviews that ask people to download and execute code on machines with access to employer material has been warned about for years, and there’s little detail on the “internal AI tool” that was used by the attackers and why it was able to help them in the first place.

目前尚不清楚的是，为什么这次特定的攻击能够成功——多年来，人们一直被警告，在能够访问雇主资料的机器上下载并执行代码的求职面试存在危险，而且关于攻击者使用的“内部人工智能工具”以及它为何能为攻击者提供帮助的细节也知之甚少。