North Korean fake job interview led to $6.3B Binance heist

本文为原文前 6,000 字符的节选翻译，完整内容请查看原文。

‘It was not a single isolated breach or a simple phishing incident,’ exchange says

“这并非单一的孤立漏洞，也不是简单的网络钓鱼事件，”该交易所表示。

North Korean cryptocurrency thieves tricked a Binance software engineer into downloading malware onto their work-issued computer during a fake job interview process before last week’s record-breaking $6.3 billion heist.

在上一周创纪录的 63 亿美元失窃案发生前，朝鲜加密货币窃贼通过虚假的面试流程，诱骗一名币安（Binance）软件工程师在其工作电脑上下载了恶意软件。

In an incident report published on Tuesday, the cryptocurrency exchange said several techniques - including social engineering via fake job interviews, malware downloads, compromised internal AI tooling, endpoint takeover, and an “advanced transaction-authorization method” - led to the October 29 security breach.

该加密货币交易所在周二发布的一份事故报告中称，多种技术手段导致了 10 月 29 日的安全漏洞，包括通过虚假面试进行的社会工程学攻击、恶意软件下载、内部 AI 工具被入侵、终端接管以及一种“高级交易授权方法”。

“Our current investigation indicates that this was a sophisticated, multi-stage campaign,” the incident report said. “It was not a single isolated breach or a simple phishing incident.”

“目前的调查显示，这是一场复杂的多阶段行动，”事故报告称，“这并非单一的孤立漏洞，也不是简单的网络钓鱼事件。”

Over the weekend, the FBI attributed the theft to TraderTraitor, a North Korean hacking operation linked to Lazarus Group, known for combining espionage with massive cryptocurrency heists. The Pyongyang-backed crew is also highly adept at job market scams - both posing as IT workers, who are then hired by Western companies, and as potential employers to lure software engineers into downloading malware and infecting corporate devices.

周末，美国联邦调查局（FBI）将此次盗窃案归咎于 TraderTraitor，这是一个与 Lazarus 组织有关联的朝鲜黑客行动，该组织以将间谍活动与大规模加密货币盗窃相结合而闻名。这个受平壤支持的团伙也非常擅长就业市场诈骗——他们既伪装成 IT 工作者被西方公司聘用，也伪装成潜在雇主，诱骗软件工程师下载恶意软件并感染企业设备。

With the recent Binance attack, the Norks used the latter.

在最近的币安攻击事件中，朝鲜黑客使用了后者。

The attack prep began back in June with a supply chain attack when one of its engineers downloaded a malicious Homebrew installation. While the malware was detected by the security team, the device was replaced, and all affected credentials rotated, “Engineer A’s role and his related colleagues on our wallet infrastructure team was exposed to the hacker,” the report says.

攻击准备始于今年 6 月的一次供应链攻击，当时该交易所的一名工程师下载了一个恶意的 Homebrew 安装包。尽管安全团队检测到了该恶意软件，并更换了设备并轮换了所有受影响的凭据，但报告称，“工程师 A 的角色及其在钱包基础设施团队的相关同事已暴露给黑客。”

Three months later, the social engineering part of the attack happened.

三个月后，攻击中的社会工程学部分发生了。

In September, another software engineer was contacted via a “legitimate job-hunting platform” by someone purporting to be a project director who arranged a series of job interviews for the Binance engineer with the fake company. During the first round - a live video interview with the engineer and a fake HR rep - the interviewer “shared a social media account with him, including personal photos and videos posted on the platform, in order to build trust,” according to the report. “This was more advanced and deceptive than previously seen social engineering approaches.”

9 月，另一名软件工程师通过一个“合法的求职平台”被一名自称是项目总监的人联系，此人安排了该币安工程师与这家虚假公司的一系列面试。据报告称，在第一轮面试中——即工程师与一名假冒人力资源代表进行的实时视频面试——面试官“与他分享了一个社交媒体账号，包括平台上发布的个人照片和视频，以建立信任。这比以往见过的社会工程学手段更先进、更具欺骗性。”

The second interview with someone purporting to be the CEO of the phony company was conducted on a “popular social chat app,” and toward the end, the CEO instructed the engineer to download an “assignment” containing a malware-laced code repository. The code executed on his work computer during the setup process, which kicked off a series of unauthorized activities.

与一名自称是该虚假公司首席执行官的人进行的第二次面试是在一个“流行的社交聊天应用”上进行的。在面试快结束时，这位“首席执行官”指示工程师下载一份包含恶意代码库的“作业”。该代码在设置过程中于其工作电脑上执行，从而引发了一系列未经授权的活动。

According to Binance, the malware replaced a legitimate development tool component with a malicious version, which executed commands and established communication with an attacker-controlled external server. The attackers also took steps to hide the malicious script and evade detection, and it worked. Binance’s endpoint security tools did not immediately detect the malware.

据币安称，该恶意软件将一个合法的开发工具组件替换为恶意版本，该版本执行命令并与攻击者控制的外部服务器建立了通信。攻击者还采取了隐藏恶意脚本和逃避检测的措施，并且奏效了。币安的终端安全工具未能立即检测到该恶意软件。

CREATE /opt/homebrew/Cellar/pyenv/2.8.0/libexec/pyenv_

创建 /opt/homebrew/Cellar/pyenv/2.8.0/libexec/pyenv_

MODIFY pyenv_ → 3,414 B

修改 pyenv_ → 3,414 字节

DELETE …/libexec/pyenv (3,344 B) ← remove the valid pyenv

删除 …/libexec/pyenv (3,344 字节) ← 移除有效的 pyenv

RENAME pyenv_ → pyenv (3,414 B) ← replace it with a malicious version

重命名 pyenv_ → pyenv (3,414 字节) ← 用恶意版本替换它

DELETE /opt/homebrew/bin/pyenv (3,414 B)

删除 /opt/homebrew/bin/pyenv (3,414 字节)

ln (create a new symlink) + spawn zsh

创建新的符号链接 + 启动 zsh

Then, on October 20, the miscreants used the compromised computer and an internal AI tool to gain access to the computers of wallet DevOps engineer A and another wallet software developer, Engineer C.

随后，在 10 月 20 日，这些不法分子利用被入侵的电脑和一个内部 AI 工具，获得了钱包 DevOps 工程师 A 和另一名钱包软件开发人员（工程师 C）电脑的访问权限。

Engineer A had a container deployment permission token on his computer, which the Norks soon discovered. On October 29, the attacker accessed Engineer C’s computer, used the stolen credentials from Engineer A to deploy a container, and triggered a script to launch the cryptocurrency-stealing attack.

工程师 A 的电脑上有一个容器部署权限令牌，朝鲜黑客很快发现了这一点。10 月 29 日，攻击者访问了工程师 C 的电脑，利用从工程师 A 那里窃取的凭据部署了一个容器，并触发了一个脚本来发动加密货币盗窃攻击。

As of Tuesday, Binance said it has rebuilt the compromised wallet system and internal AI tool, and replaced all of the affected devices. It also decommissioned all credentials and tokens assigned to the compromised engineers, and is working with law enforcement, blockchain intel firms, and security researchers to trace and freeze the assets.

截至周二，币安表示已重建了被入侵的钱包系统和内部 AI 工具，并更换了所有受影响的设备。它还停用了分配给受影响工程师的所有凭据和令牌，并正在与执法部门、区块链情报公司和安全研究人员合作，以追踪并冻结这些资产。

The crypto exchange has also hired independent cybersecurity experts to conduct a cybersecurity review of the incident, and recommend additional protective measures. Binance said it’s also working to establish a security research fund and initiatives with AI companies and security shops to focus on AI security in blockchain environments.

该加密货币交易所还聘请了独立的网络安全专家对此次事件进行网络安全审查，并建议采取额外的保护措施。币安表示，它还致力于与 AI 公司和安全机构建立安全研究基金和倡议，以专注于区块链环境中的 AI 安全。