Binance Finds Zero-Day Trojan in Fake Recruiting Attack

Binance’s preliminary investigation found that a fake hiring process planted a zero-day trojan on an engineer’s work computer before the theft on Thursday, Oct. 29, which affected about $6.3 billion in assets.

Binance said a software engineer was contacted in September through a legitimate job platform by someone posing as a project director. The engineer completed a fake human resources video interview and a second round with someone posing as a CEO. The engineer then received a coding assignment to download onto a work computer. Its repository contained a trojan that bypassed endpoint protections, Binance said.

Binance said attackers used the compromised device and an internal AI tool to access computers used by two wallet engineers and steal deployment credentials. A malicious script moved the funds on Oct. 29.

Binance said about $2.85 billion had been frozen or intercepted and 98% of affected assets had been replenished.

The investigation compared the approach with the March 2022 theft from Axie Infinity’s Ronin bridge. A fake job offer targeting a Sky Mavis engineer preceded the theft of about $625 million from the bridge.