HN

Comments (213)

• Menu

  gandreani
  A lot of people are focusing on how irresponsible the engineer was about using the work computer. That's obviously an issue but the bigger failure mode to me is the Engineer C's container deployment token.That's a huge red-flag. In a company of this size, the deployments should be via CI only. CI isn't just to increase the speed and reliability of deployments but also to provide a clean room to build the software! Even if it's a token that was copied and pasted temporarily, the systems in place should not have to require this type of 1. copy 2. paste 3. remember-to-delete the token from my PC.Also, Binance should be paying for intrusion testing. Better to pay a trusted company to do this kind of thing instead of letting North Korea show you how it's done. I don't think this exact exploit path would have been found but I bet the intrusion testing would have figured out another way to use Engineer C's token.
• Menu

  bilekas
  Doing ANYTHING on a work issued laptop outside of your role is such a dumb idea for a litany of obvious reasons that I'm genuinely shocked people do it. Let alone participate in interviews for other companies on it.
• Menu

  steveBK123
  Pretty funny that tech makes candidates jump through all sorts of automated, inhumane loops to even advance to talking to a real human in the hiring process.And now you get results like this.
• Menu

  xutopia
  I was #opentowork on LinkedIn and got approached multiple times with fake companies and interviews. LinkedIn is not doing enough to combat this.I even create a 1 man company for my consulting services and I receive ads about how people at my company saved me a spot on an online game.LinkedIn is partially responsible for their neglect here.
• Menu

  armcat
  I actually got contacted by North Koreans posing as Japanese VC looking to partner in the Nordics. I have an agent that scans my emails and does the inverse filtering, suggests when I should take a look. This is because I get insane amount of cold inbound. But it also flags suspicious emails and uses network tools to find out info about the sender. It flagged that one as a NK account (I later confirmed it was already flagged on the watch list in various reddit channels). Everyone should be arming themselves with email filtering agents now. What I’m worried about is grandmas and grandpas and general ppl that are behind the tech curve.
• cwiggs
  No one wants to talk about the "internal AI Tool" being used to elevate to not 1 but 2 DevOps engineers?> use of an internal AI tool as a springboard. The attacker leveraged the compromised computer of engineer B and used an internal AI tool to gain control over the Wallet DevOps Engineer A and another Wallet Software Engineer C. The attacker soon discovered Wallet DevOps Engineer A had a container deployment permission token on his computer.With the AI craze going on recently I've worked at multiple companies where an internal AI tool was vibecoded and I've always been worried about the security implications.
• Menu

  sva_
  It is crazy that this Engineer A fell for this malware ad (how do people still fall for these & how does Google still get away with serving malware like that):https://isc.sans.edu/diary/32942It is kind of weird that they mention it though, if they replaced the devices and rotated credentials? Just to later mention that an "internal AI tool" was used to steal that Engineer As credentials again?And also, what are those "obfuscation techniques"? It looks very straight forward, replacing the pyenv, there's nothing much obfuscated in it? Except for putting it in a different folder.
• Menu

  DrBazza
  Anec-data - as an interviewer, last year, I had my first sketchy, perhaps 'North Korean', candidate.The name on the CV, was, for the sake of privacy, Michael Smith, from Australia, and ticked the right boxes.We'd expect a fluent, Aussie-accented English speaker. Instead, we had a candidate with a webcam that wouldn't work (weird!!), with clearly accented English of a East-Asian background. I suppose there's a vanishing chance they really were Mike Smith of Adelaide or wherever, but we couldn't take that chance. We tried rescheduling, but tumbleweeds...
• barbazoo
  The way I read the Binance post[0] is that the first mistake was "Engineer A from Wallet DevOps" clicking on a malicious Google ad[1]. If Google didn't provide that attack vector, maybe this wouldn't have happened that time.[0] https://www.binance.com/en/blog/community/322915344375956676...[1] https://isc.sans.edu/diary/32942
• stefap2
  It's getting really confusing with these online job offers, including interviews and assignments. Various people are pretending to be recruiters. I've basically stopped answering phone calls, and everything goes to voicemail unless the caller is in my contacts. But that is hard to do if you are looking for a job. Honestly, if you are the target of this type of campaign, as described in this article, there is probably a good chance you will get compromised, even if you are normally careful.
• inChargeOfIT
  No single person, especially an engineer, should have the ability to transfer funds. That's nuts and it says a lot about the security posture of that company.
• giantg2
  Yeah, lots of good conversation on steps to take. One thing I never see mentioned is who should review and test them. Especially for a financial company, it seems they have no IT compliance/audit functions. Even at many big companies it seems IT control creation, maintenance, and testing is largely ignored or just put onto the people implementing and performing the control - a huge conflict of interest. Control analyst posting are something like 1 to 10K when measured against dev postings. Really telling when it comes to what companies actually care about...
• maeln
  Recently, I was designing a technical test for a candidate and I thought about putting some prompt injection to try to see if the candidate used an agent and be part of a cybersecurity tests. I didn't do it because it felt unethical, but turns out you don't even need the prompt injection part.
• veltas
  Imagine being able to steal billions in crypto from your work laptop and using same laptop to run code sent to you by another company. I wish I had their problems.
• Menu

  paxy
  Why did the employee have direct access to $6.3 billion in customer funds?
• Menu

  HelloUsername
  Source posted earlier: "29 October Binance Security Incident: Initial Findings and Response Update" https://news.ycombinator.com/item?id=50359377
• tasuki
  > Binance’s endpoint security tools did not immediately detect the malware.Yes of course they didn't. The whole "endpoint security" industry is a scam. They're attempting to (or attempting to appear to) solve an impossible problem. All they do is install spyware and backdoors, reducing security rather than enhancing it.
• Menu

  mynegation
  Running interview assignment on a work computer… tsk tsk
• AlexITC
  I have been getting these since early 2023, still, most of them are simple to spot, the other side typically has video turned off, asks a bit about your experience and just nods without digging, they are in a hurry to send you their coding challenge.In one of these many calls I got to see the face from the other side but lasted a few seconds only. Then he claimed that internet was bad and suggested we continued without video.In this case they claim it was a 2 rounds interview with video turned on to simulate a more normal recruiting process.Of course all of us are prone to get caught with the shield off but what surprises me is that the targeted dev took the challenge in the device from work.
• kfichter
  Obligatory and should be obvious: a threat model that allows a single compromised laptop to result in a $6.3B loss is fundamentally flawed. Analyze the specific way that the laptop was compromised all you want, the fault here is entirely with the Binance security culture that allows such a gaping hole to exist in the first place.I hope that Binance understands this and spends less time worrying about how the laptop was compromised and more time securing their systems under the very basic assumption that laptops will be compromised.
• james_marks
  Further evidence that 1) recruiting is broken and 2) developers make great targets, and we need to respond accordingly.
• 129-1
  The practice of installing software during a job interview should be forbidden by law.Some companies require you to install Windows remote administration tools (basically root kits) on your machine to check whether you are using search engines or AI. It is insane.
• TeriyakiBomb
  insert “Oh no! Anyway…” Jeremy Clarkson meme
• Menu

  anon84873628
  I suspect we'll look back on "Nork" as a derogatory racial term that didn't need to be used here. Just call them the attackers, or by their group name, or whatever.
• gosen
  It's just a cherry on top of the existing hiring process in the IT. It wouldn't surprised that it will make things even worse - companies will be more scared to talk to anyone and good candidates will be scared to reply
• ETH_start
  North Korea's open hostility to Western systems combined with its highly proficient human capital creates a bizarre situation where a formidable state-level actor is waging unrelenting warfare against private companies that operate in the Western-led global economic system, and due to the nature of the internet and North Korea's nuclear deterrent, there is no way to force that actor to stop.
• 1970-01-01
  These are simply malicious interviews, not fake. If your company is important enough, you've got one or two inside already.
• Menu

  aleksandrm
  How do these dumb people that have access to billions of funds fall to these fake interviews?
• BigTTYGothGF
  Good thing they didn't get anything important.
• throwitaway222
  I think we have reached peak whatever we're in. I think from here on out, things are gonna change.
• tehjoker
  There is no evidence given that North Korea did this."TRM attributes this attack to TraderTraitor, North Korea’s premier hacking unit. We base this assessment on robust on and off-chain intelligence sources. The FBI named the same group as responsible for the USD 1.5 billion Bybit hack in February 2025. Several features of this attack match earlier North Korea-linked heists, including the Bybit hack and the KelpDAO hack in April 2026: small Tornado Cash withdrawals funding an operator wallet, staging that began well before the theft, and signatures obtained in advance then executed in one burst. The laundering observed so far, built on large swaps through market makers and lending protocols, differs from the bridge-heavy pattern that followed Bybit. TRM will share further findings as the investigation develops."https://www.trmlabs.com/resources/blog/north-korea-steals-us...This is simply an assertion that an official enemy did something we don't like. It could just as well be a CIA money laundering scheme. This would make more sense, given the wider deployment of US cyber weapons and assets as well as the desire of North Korea not to provoke American aggression which previously murdered about 20% of their population.It is widely known America has cyberweapons deployed around the globe. It is likely trivial for them to fake a trail of evidence from the DPRK.
• Menu

  dboreham
  My hunch is that this was partly an inside job. The "fake job interview" and "mistakenly downloaded trojaned homebrew" stories are to give plausible deniability. But they're not very plausible imho.
• gyanchawdhary
  Founder of Callstrike here .. we build real time deepfake & voice impersonation attack simulation tools for a living so this is literally what I deal with every day.The biggest irony is that we get at least a couple of signups every month from South Korea, Russia, India, Nigeria just to try getting access to our platform for running these attacks ..Here is the most recent copy paste from a Calendly invite ..>Invitee Email: >ashley@cairnsovereign.net>Invitee Time Zone: >Central European Time>Questions:>Please share anything that will help prepare for our meeting.>We are an MSP from the UK that is look for a deepfake platform to run campaigns for our clients. We typically use open source software but there is a gap in our portfolio for deepfake testing that we can't fill with our usual open source philosophy.The company website https://www.cairnsovereign.net/ was registered just 2 days ago .. they have no linkedin presence, fake CEO and fake CTO and fake everything ..I still accepted the invite and joined and the person has a strong northern british accent .. he askd me to let his AI bot join the call to take notes ... i refused .. to which he swore and said that if a meeting bot is not allowed .. then i dont want to talk and abruptly hung up ...PS: if anyone wants to see .. this is what a real time voice impersonation call and real time deepfake faceswap .. looks like ..https://www.callstrike.ai/deepfake-security-traininghttps://www.callstrike.ai/voice-phishing-simulator
• aleph_minus_one
  What surprises me most about the Binance hacking story is that Binance employees seem to have used their work laptops for some "programming test" (whose purpose was - as we now know - spreading malware).I mean: if you even consider leaving your current company, you better leave no traces of your plan on your work laptop: you either use a private laptop or, even better, some burner laptop/computer that you reset afterwards.
• Menu

  nurumaik
  Pretty sure it was his last job interview ever
• bethekidyouwant
  This is insane. The first engineer ran some curl bash, which gave the hackers access to his Slack, and then they set up an interview for him at a fake company and during that interview, they convinced an engineer to download and install some code they had written? This is just clown world.
• Menu

  flerchin
  If she hadn't done it on her work laptop, her personal would have been pwned anyway. It's not clear to me how to protect oneself while also looking for work.
• up2isomorphism
  People are talk about all the security aspects of this which are all valid. But what I saw here is that Binance is running a sweatshop here. So even someone holding secret for billions is actively looking for potential role from a Noname company.
• anon
  undefined
• simianwords
  After reading this story I understood that a lot of pieces had to come together to make the plan work. It was a huge long shot from the start and that makes me wonder how many times they must have tried this in the past? To make long shots like this work they must have tried relentlessly; they would've tried hundreds of thousands of developers before this
• odyssey7
  Where do these people find jobs so secure that they wouldn’t bat an eye at interviewing for another job in a context where their current employer can watch them do so?Even if you don’t understand the security concerns of running some 3rd party’s scripts on a work device, more pedestrian situational awareness should have prevented such a wild misjudgment?
• vrganj
  If you want to learn more about the Lazarus group behind this heist, the BBC did an excellent podcast on another one of their operations:https://www.bbc.com/audio/series/w27vqd03(It's also on Spotify, Apple Podcasts etc)
• Menu

  Jianghong94
  Am I the only one baffled by the fact that the engineer uses a work PC for a personal job interview assignment?
• asadotzler
  Letting lowbies have any credentials that can escalate to the vault is what what led to the heist.
• Menu

  kittikitti
  Zoom exploits could have done this without downloads. I don't interview on a computer with sensitive data, it's usually a throwaway. I sometimes get judged for doing the interview on a Chromebook or an old Mac and I hope that interviewers understand why I choose to do it this way.
• Menu

  toss1
  >> "...and is working with law enforcement, blockchain intel firms, and security researchers to trace and freeze the assets. The crypto exchange has also hired independent cybersecurity experts to conduct a cybersecurity review of the incident, and recommend additional protective measures.">> trace and freeze the assetsIt has gotten to the point where the advertised permanence of cryptocoin transactions is a serous national security threat, literally funneling $6+billion to a nation-state whose publicly avowed statements is to destroy the US to fund its nuclear weapons program.The party is ending. The house lights are flashing. Crypto will either become controlled so illegitimate transactions will be roll-back-able (presumably with proper court or NatSec orders), or it will be banned.
• Menu

  moralestapia
  This is Binance/CZ's version of the story, but no one really knows the truth.They have a massive incentive to invent a story to cover up the incident. I'm not saying it's a cover-up, but the motive is definitely there.North Korea has denied responsibility, whereas they usually own up to their actions.Disregarding that, it just doesn't make sense for their internal security to be so lax.I've worked at big companies but with AUM lower than Binance, a lot of control and safeguards are in place to prevent one "rogue" employee from stealing everything.It's pretty much impossible for a company like Binance to not have implemented such things. I do not buy it.
• ChrisArchitect
  [dupe] https://news.ycombinator.com/item?id=50353818
• lern_too_spel
  Anybody who thinks this can be prevented from happening again is deluding themselves. I'm looking forward to the MSTR heist writeup when it happens.
• FLeXMurphy
  I love these guys!
• worksonmine
  A lot of detail on what Engineer A, B and C did. But this would've been prevented if Engineer A didn't have "a container deployment permission token on his computer".What the fuck? On a target as big as Binance? Every developer should be treated as a liability and never be able to deploy by themselves.
• pants2
  [dead]
• jxie2004
  [flagged]
• agentriskdesk
  [flagged]
• devilfileprong
  [dead]
• AlexRinconTradi
  [flagged]
• dust42
  Move fast and break things. 4-eyes principle is for brick-and-mortar banks stuck in the prehistoric past of paper money. /s
• mike_bob
  Guy probably skipped his "mandatory" KnowBe4 training... see HR actually does serve a purpose! /s
• daninfpj
  [dead]
• Menu

  CommanderData
  It's strange companies haven't cracked something as basic as remote hiring checks yet.There are tools available to stop AI screen recording tools, fake candidate tools yet many companies keep getting hit..
• gadders
  I think we need to implement a new handshake protocol for job interviews.Both candidate and recruiter have to call Kim Jong Un a big fat tosser (other swearwords are available) on a recorded video before the interview continues.https://www.youtube.com/watch?v=g7v2clX8ynE