Binance hackers spent months setting up a fake job interview

Hackers took more than $6 billion in cryptocurrencies from Binance customers last week in an attack that lasted about 20 minutes, according to an initial assessment the crypto exchange released Tuesday.

The FBI has identified the attackers as TraderTraitor, a North Korean state-sponsored military unit. Binance called it the largest cyber heist in the world.

The intrusion began in June, when the hackers tested Binance's security systems. Binance detected that attempt and stopped it. The failed effort still gave the group information about the exchange and how its systems worked.

In September, a Binance engineer was contacted on a job-hunting platform by a person posing as a project director at a company that turned out to be fictitious. The engineer did a first-round interview with a supposed HR representative. Binance said the hackers used that meeting to build trust with the employee, sharing supposed social media accounts along with personal photos and videos.

Binance said the approach "was more advanced and deceptive than previously seen social engineering approaches." The engineer was told a second interview with the supposed CEO would happen on a popular social chat app. During that meeting, the employee, working on his company laptop, was asked to download an assignment as part of the hiring process. The file contained malicious code.

That code let the hackers build out the attack that ended with the theft of more than $6 billion held by Binance customers. Binance said Monday it had already replaced most of the stolen cryptocurrencies using its own funds. The exchange said it is commissioning an independent cybersecurity review to prevent future attacks.

"This should not have happened," Binance said in its assessment. "And we apologise for the concern, disruption and uncertainty it caused our users, partners and the wider industry."