Researchers warned of North Korean hacking tactics years before record $6.3B Binance heist

Crypto giant Binance says North Korean hackers used fake social media profiles and the lure of a potential job offer as part of a months-long scheme aimed at tricking an employee into downloading malicious software onto their laptop. Researchers have repeatedly warned about long-running social engineering attacks that can go on for months.

加密货币巨头币安（Binance）表示，朝鲜黑客利用虚假的社交媒体资料和潜在的工作机会作为诱饵，实施了一项长达数月的计划，旨在诱骗一名员工在其笔记本电脑上下载恶意软件。研究人员曾多次警告过这种可能持续数月的长期社会工程学攻击。

This latest attack allowed the hackers to patiently worm their way into Binance’s systems to steal a record $6.3 billion in crypto last week, the company has now confirmed. The hack, disclosed in an updated statement posted on X on Tuesday, prompted the world’s largest crypto exchange to suspend customer withdrawals across its network.

币安现已证实，这次最新的攻击使黑客能够耐心地渗透进币安的系统，并在上周窃取了创纪录的 63 亿美元加密货币。此次黑客攻击于周二在 X 上发布的一份更新声明中披露，促使这家全球最大的加密货币交易所暂停了其网络上的客户提现。

The FBI and blockchain investigators have blamed North Korea for the heist. The country has been long accused of carrying out massive cryptocurrency thefts in recent years to fund its internationally sanctioned nuclear weapons program.

美国联邦调查局（FBI）和区块链调查人员将此次盗窃案归咎于朝鲜。长期以来，该国一直被指控近年来实施了大规模的加密货币盗窃案，以资助其受到国际制裁的核武器计划。

In its latest statement, Binance said that North Korean hackers, posing as recruiters hiring for a job, contacted a software engineer who works on wallets at the company. Following two interviews with the purported company, the engineer was instructed to download an apparent coding assignment as part of the interview process.

币安在最新的声明中表示，朝鲜黑客冒充招聘人员，联系了一名在公司负责钱包业务的软件工程师。在与所谓的“公司”进行了两次面试后，该工程师被要求下载一份看似编码作业的文件，作为面试流程的一部分。

When opened, the assignment contained malicious code that compromised the engineer’s work-issued laptop. Binance said its security tools did not detect the malware. That foothold in Binance’s network allowed the hackers to access an internal tool capable of taking over the work computers of two other engineers on the wallet team.

打开后，该作业中包含的恶意代码破坏了这名工程师的工作笔记本电脑。币安表示，其安全工具未能检测到该恶意软件。在币安网络中获得的这一立足点，使黑客能够访问一个内部工具，从而接管了钱包团队另外两名工程师的工作电脑。

One of those engineers had unwittingly downloaded a tampered app containing password-stealing malware months earlier after searching for the software in search engine results. While Binance replaced that compromised engineer’s laptop, the hackers used the engineer’s stolen credentials to break into the computer of a third engineer, whose job allowed them access to systems capable of controlling billions of dollars in crypto.

其中一名工程师在几个月前通过搜索引擎搜索软件时，无意中下载了一个被篡改的应用程序，其中包含窃取密码的恶意软件。虽然币安更换了该名受影响工程师的笔记本电脑，但黑客利用窃取的凭据入侵了第三名工程师的电脑，而该工程师的工作权限使其能够访问控制数十亿美元加密货币的系统。

Binance said the attack “should not have happened,” and that it had improved its network security following the theft. The hack underscores an ongoing tactic in the North Korean regime’s repertoire of attacks targeting the crypto industry and high-net worth individuals.

币安表示，这次攻击“本不应该发生”，并称在盗窃事件发生后，公司已经加强了网络安全。此次黑客攻击凸显了朝鲜政权针对加密货币行业和高净值个人的一贯攻击策略。

Researchers have warned for years that North Korean hackers pose as venture capitalists, investors, and recruiters using dossiers of stolen American identities to trick employees into granting access to their systems. These attacks are widely known across the crypto industry and have been the subject of repeated warnings from the U.S. government and cybersecurity giants in recent years.

多年来，研究人员一直警告称，朝鲜黑客会冒充风险投资家、投资者和招聘人员，利用窃取的美国人身份档案，诱骗员工授予其系统访问权限。这些攻击在加密货币行业广为人知，近年来也一直是美国政府和网络安全巨头反复发出警告的对象。

Some half of all intrusions at U.S. tech companies last year were attributed to North Koreans posing as remote IT workers and fake recruiters. By Binance’s own account, the company faced at least 57 suspected attacks from North Korea, which it said reflect the “persistent threat posed by state-sponsored actors targeting the cryptocurrency industry.”

去年美国科技公司遭受的所有入侵事件中，约有一半被归咎于冒充远程 IT 工作者和虚假招聘人员的朝鲜人。据币安自行统计，该公司至少面临了 57 起来自朝鲜的疑似攻击，币安称这反映了“国家支持的参与者针对加密货币行业构成的持续威胁”。

But how the hackers were able to convince the engineer into downloading malware given the highly publicized threat, and bypass security weaknesses in Binance’s own network, will likely be the focus of investigators’ attention. While the case exposes how North Korean hackers use social engineering, such as offers of employment, to trick employees into granting access to their systems, it’s ultimately the responsibility of the company to ensure its systems cannot run unauthorized or untrusted software that could cause a compromise.

然而，鉴于此类威胁已广为人知，黑客是如何说服工程师下载恶意软件并绕过币安自身网络安全漏洞的，这很可能成为调查人员关注的焦点。虽然此案揭示了朝鲜黑客如何利用就业机会等社会工程学手段诱骗员工授予系统访问权限，但确保系统无法运行可能导致安全受损的未经授权或不可信软件，最终仍是公司的责任。

A Binance spokesperson referred to the company’s public statement but declined to answer TechCrunch’s questions on the record about the incident. Those questions included how Binance prevents unauthorized or malicious code from running on its employees’ laptops, if at all, and whether any third parties had performed cybersecurity audits of Binance’s network prior to the hack.

币安的一位发言人提到了公司的公开声明，但拒绝就此事回答 TechCrunch 的正式提问。这些问题包括币安如何防止未经授权或恶意代码在其员工笔记本电脑上运行（如果确实有防范措施的话），以及在黑客攻击发生前是否有第三方对币安的网络进行过网络安全审计。

The company said it would bring in cybersecurity experts to review the incident and has put new security measures in place to prevent a repeat incident. The heist remains the largest theft of crypto in history.

该公司表示将聘请网络安全专家对此次事件进行审查，并已采取新的安全措施以防止类似事件再次发生。此次盗窃案仍是历史上规模最大的加密货币盗窃案。