Kriptovalyuta birjasi Binance ma'lum qilishicha, Shimoliy Koreya xakerlari soxta ish suhbatidan foydalanib, xodimni zararli dastur o'rnatishga aldashgan, bu esa oxir-oqibat kompaniya hamyon infratuzilmasini buzib kirish va taxminan 6,34 milliard dollar raqamli aktivlarni o'g'irlashga olib kelgan.
Bu yangi ma'lumot bugun e'lon qilingan hodisa hisobotida keltirilgan bo'lib, unda hujumchilar ijtimoiy muhandislik, zararli dasturiy ta'minot va buzilgan ichki tizimlardan foydalanib, 29-oktabrda sodir etilgan kripto o'g'irlikni qanday amalga oshirgani batafsil bayon etilgan.
Avvalroq BleepingComputer xabar berganidek, FBI hujumni Shimoliy Koreya davlat homiyligidagi xakerlarga — TraderTraitor nomi bilan tanilgan, shuningdek Lazarus Group, Jade Sleet va APT38 deb ham kuzatiladigan guruhga bog'lagan.
Binance ma'lum qilishicha, hujum sentyabr oyida boshlangan, o'shanda dasturiy ta'minot muhandisi qonuniy ish qidirish platformasi orqali soxta kompaniya loyihasi direktori sifatida o'zini ko'rsatgan shaxs bilan bog'langan.
Xodimning profili uning Binance'dagi tajribasini ko'rsatgan, bu esa kriptovalyuta birjasini buzib kirishni maqsad qilgan hujumchilar uchun uni qimmatli nishonga aylantirgan.
Soxta yollovchi xodim bilan ikkita suhbat rejalashtirgan: avval inson resurslari vakili sifatida o'zini ko'rsatgan shaxs bilan, keyin esa kompaniya bosh direktori deb da'vo qilgan boshqa shaxs bilan.
Birinchi suhbat davomida soxta HR vakili jonli video qo'ng'iroq o'tkazgan va ishonch qozonish maqsadida shaxsiy fotosuratlar va videolar bilan ijtimoiy tarmoq akkauntini ulashgan.
Ikkinchi suhbat mashhur ijtimoiy chat ilovasi orqali o'tkazilgan bo'lib, unda xodimga onlayn kod omboridan kodlash topshirig'ini yuklab olish buyurilgan.
Binance ma'lumotiga ko'ra, ombor zararli kodni o'z ichiga olgan bo'lib, u bajarilganda xodimning qurilmasini avval ko'rilmagan maxsus zararli dastur bilan buzgan, bu dastur antivirus dasturlari tomonidan aniqlanmagan.
"Zararli dastur murakkab yashirish va chetlab o'tish usullaridan foydalangan, jumladan, qonuniy ishlab chiqish vositasi komponentini zararli versiya bilan almashtirib, buyruqlarni bajarish va hujumchi nazoratidagi tashqi server bilan aloqa o'rnatish uchun ishlatilgan", — deb tushuntirgan Binance.
"0-kun zararli dasturi o'sha paytda yakuniy nuqta xavfsizlik himoya vositalari tomonidan aniqlanmagan. Hujumchi shuningdek, zararli faoliyatni yashirish va buzilish izlarini o'chirish choralarini ko'rgan, bu esa aniqlash va keyingi tekshiruvni qiyinlashtirgan."
Binance tushuntirishicha, zararli skript macOS Homebrew o'rnatish katalogida pyenv_ nomli almashtirish bajariladigan faylini yaratgan.
Skript keyin qonuniy pyenv bajariladigan faylini o'chirgan, zararli faylni pyenv deb qayta nomlagan, uning ramziy havolasini o'zgartirgan va undan Z shell (zsh) jarayonini ishga tushirish uchun foydalangan.
Zararli almashtirish hujumchilarga hujumchi nazoratidagi serverdan olingan buyruqlarni bajarish imkonini bergan.
20-oktabrga kelib, hujumchilar buzilgan muhandis kompyuteri va ichki sun'iy intellekt vositasidan foydalanib, Binance hamyon infratuzilmasida ishlaydigan yana ikkita xodimni buzib kirgan, ularning ma'lumotlari va konteyner joylashtirish tokenini qo'lga kiritgan.
29-oktabrda xakerlar o'g'irlangan ma'lumotlardan foydalanib, zararli skriptni joylashtirgan va Binance hamyon imzolash xizmatiga ruxsatsiz kirish huquqini olgan, bu esa ularga bir nechta blokcheynlar bo'ylab milliardlab dollar kriptovalyutani o'tkazish imkonini bergan.
Hujumchilar shuningdek, Ethereum'ning EIP-7702 avtorizatsiya mexanizmini suiiste'mol qilgan, bu esa birja pul yechib olishni to'xtatganidan keyin ham kriptovalyutani o'g'irlashni davom ettirishga imkon bergan.
Binance ma'lum qilishicha, u shundan beri ta'sirlangan tizimlarni qayta qurib chiqqan, buzilgan qurilmalarni almashtirgan va o'g'irlangan ma'lumotlarni bekor qilgan.
3-noyabr holatiga ko'ra, o'g'irlangan aktivlarning taxminan 2,85 milliard dollari muzlatilgan yoki ushlab qolingan, 31-oktabr holatiga ko'ra esa ta'sirlangan token aktivlarining 98 foizi to'ldirilgan.
Binance ma'lum qilishicha, u buzilishni tekshirishni davom ettirmoqda va o'z xulosalarini ko'rib chiqish uchun mustaqil xavfsizlik firmalarini jalb qilgan.
Zararli ish suhbatlari
Zararli dastur o'rnatishga olib keladigan soxta ish suhbatlari Shimoliy Koreya xakerlik kampaniyalarida keng tarqalgan taktika bo'lib, ular Contagious Interview va Operation Dream Job nomlari bilan tanilgan. Bu kampaniyalar soxta ish takliflari va suhbatlardan foydalanib, ishlab chiquvchilar va kriptovalyuta xodimlarini zararli dastur o'rnatishga aldashadi.
2025-yil iyun oyida kiberxavfsizlik firmasi Socket Contagious Interview kampaniyasi LinkedIn'da yollovchilarni taqlid qilgani va ishlab chiquvchilarga zararli npm paketlarini o'z ichiga olgan kodlash topshiriqlarini yuborgani haqida xabar bergan.
Bu hujumlar doirasida xakerlar 35 ta zararli npm paketini tarqatgan, ular zararli dastur o'rnatib, brauzer ma'lumotlari, kriptovalyuta hamyon ma'lumotlari va boshqa ma'lumotlarni yuqtirilgan kompyuterlardan o'g'irlashga imkon bergan.
Shimoliy Koreya Lazarus xakerlari shuningdek, Operation Dream Job'da shunga o'xshash taktikadan foydalanib, dasturiy ta'minot ishlab chiqish va DeFi kompaniyalarida ishlaydigan odamlarga ish hujjatlari sifatida niqoblangan zararli dasturlarni tarqatgan.
Binance xodimning buzilishini qaysidir aniq kampaniyaga bog'lamagan bo'lsa-da, soxta yollovchi, bir nechta suhbat va zararli kodlash topshirig'idan foydalanish avval hujjatlashtirilgan Shimoliy Koreya taktikalariga juda yaqin mos keladi.
Mavjud himoyangiz o'tkazib yuborishi mumkin bo'lgan elektron pochta tahdidlarini aniqlang.
Adaptive Security'ning sun'iy intellekt agentlari elektron pochta niyati, konteksti va xatti-harakatini tahlil qilib, fishing, biznes elektron pochta buzilishi va hisob-faktura firibgarligini aniqlaydi.
Microsoft 365 yoki Google Workspace'ning 14 kunlik faqat o'qish skaneri bilan nima o'tib ketayotganini ko'ring, MX o'zgarishlarsiz.
Bepul elektron pochta xavfsizlik skaneringizni boshlang.
Cryptocurrency exchange Binance says North Korean hackers used a fake job interview to trick an employee into installing malware that ultimately let them compromise the company's wallet infrastructure and steal about $6.34 billion in digital assets.
This new information was shared in an incident report published today, which details how the attackers used social engineering, malicious software, and compromised internal systems to carry out the October 29 crypto theft.
As previously reported by BleepingComputer, the FBI attributed the attack to North Korean state-sponsored hackers known as TraderTraitor, also tracked as Lazarus Group, Jade Sleet, and APT38.
Binance says the attack began in September when a software engineer was contacted through a legitimate job-hunting platform by someone impersonating a Project Director at a fictitious company.
The employee's profile referenced his experience at Binance, making him a valuable target for attackers looking to breach the cryptocurrency exchange.
The fake recruiter scheduled two interviews for the employee, first with someone posing as a human resources representative, then with another individual claiming to be the company's CEO.
During the first interview, the fake HR representative held a live video call and shared a social media account with personal photos and videos to build trust.
The second interview took place through a popular social chat application where the employee was instructed to download a coding assignment from an online code repository.
According to Binance, the repository contained malicious code that, when executed, compromised the employee's device with previously unseen custom malware that antivirus software did not detect.
"The malware employed sophisticated obfuscation and evasion techniques, including replacing a legitimate development tool component with a malicious version to execute commands and establish communication with an attacker-controlled external server," explained Binance.
"The 0-day malware was not detected by the endpoint security protection tools at the time. The attacker also took steps to conceal the malicious activity and remove traces of the compromise, making detection and subsequent investigation more challenging."
Binance explained that the malicious script created a replacement executable named pyenv_ in the macOS Homebrew installation directory.
The script then deleted the legitimate pyenv executable, renamed the malicious file to pyenv, modified its symbolic link, and used it to spawn a Z shell (zsh) process.
The malicious replacement allowed the attackers to execute commands received from an attacker-controlled server.
By October 20, the attackers had used the compromised engineer's computer and an internal AI tool to compromise two additional employees working on Binance's wallet infrastructure, obtaining credentials and a container deployment token.
On October 29, the hackers used the stolen credentials to deploy a malicious script and gain unauthorized access to Binance's wallet signing service, allowing them to transfer billions of dollars in cryptocurrency across multiple blockchains.
The attackers also abused Ethereum's EIP-7702 authorization mechanism, allowing them to continue stealing cryptocurrency even after the exchange suspended withdrawals.
Binance says it has since rebuilt affected systems, replaced compromised devices, and revoked stolen credentials.
As of November 3, approximately $2.85 billion in stolen assets had been frozen or intercepted, while 98% of impacted token assets had been replenished as of October 31.
Binance says it is continuing to investigate the breach and has brought in independent security firms to review its findings.
Malicious job interviews
Fake job interviews that lead to malware installs are a common tactic in North Korean hacking campaigns known as Contagious Interview and Operation Dream Job. These campaigns use fake job offers and interviews to trick developers and cryptocurrency employees into installing malware.
In June 2025, cybersecurity firm Socket reported that a Contagious Interview campaign impersonated recruiters on LinkedIn and sent developers coding assignments containing malicious npm packages.
As part of these attacks, the hackers distributed 35 malicious npm packages that installed malware, allowing them to steal browser credentials, cryptocurrency wallet data, and other information from infected computers.
North Korean Lazarus hackers have also used similar tactics in Operation Dream Job, distributing malware disguised as employment documents to people working in software development and DeFi companies.
While Binance has not linked the employee compromise to either specific campaign, the use of a fake recruiter, multiple interviews, and a malicious coding assignment closely mirrors these previously documented North Korean tactics.
Uncover email threats your existing defenses may miss.
Adaptive Security's AI agents analyze email intent, context, and behavior to uncover phishing, business email compromise, and invoice fraud.
See what's getting through with a 14-day read-only scan of Microsoft 365 or Google Workspace, with no MX changes.
Start your free email security scan.
