A Fake Job Interview Was the First Step in the $6.3 Billion Binance Heist
一场假面试，是币安 63 亿美元失窃案的第一步
币安披露 63.6 亿美元失窃案细节：攻击者通过真实招聘平台接触员工，安排假的 HR 与「CEO」面试，诱导下载所谓作业代码植入恶意程序，再利用内网 AI 工具横向移动；约 28.5 亿美元已冻结或拦截。
Binance says attackers posed as recruiters and a chief executive, sent a coding exercise that installed malware, then used internal AI tools to reach other staff. Roughly $2.85 billion has been frozen.
The $6.3 billion theft from Binance began, according to the exchange's own account, with a job interview. Attackers approached employees through legitimate recruitment platforms, staged interviews with people posing as HR staff and a chief executive, and sent candidates a coding exercise to download — which installed malware.
Binance published its preliminary findings this week. The campaign ran in stages from September: a second engineer was compromised after downloading a tampered Homebrew installer, found through a search engine, while setting up a popular AI coding tool. That is a supply-chain attack in its purest form — the software was real, the installer was not.
From there the intruders moved sideways, using the infected laptops and the company's own internal AI tools to reach other employees and steal their access tokens. Binance says its endpoint protection did not detect the zero-day malware, and that the attackers replaced components of legitimate developer tools and erased their traces.
The money left quickly. Analysts at the blockchain firm TRM Labs put the transfer at about $6.36 billion in roughly 20 minutes on 29 October — the largest crypto theft on record, and about four times the $1.5 billion taken from Bybit in February 2025.
Recovering it was made harder by the wallet design. Binance's hot wallets use multi-party computation, so no single private key exists that can simply be revoked; the attackers had also used EIP-7702, a mechanism letting an account delegate execution rights to a contract, to hand authority to code they controlled. Undoing that took extra on-chain transactions rather than a password reset.
The exchange says it has rebuilt the affected systems, replaced compromised devices and revoked stolen credentials. As of 3 November about $2.85 billion had been frozen or intercepted, and 98% of affected assets had been replenished by 31 October. An independent security firm has been hired to review the findings.
The lesson is less about cryptocurrency than about people. The weakest link was not a curve or a cipher but a developer who believed they were applying for a job, and an installer that looked exactly like the one everybody else downloads.
中文翻译（全文）
据币安自己的说法，这起 63 亿美元的失窃案始于一场面试。攻击者通过正规招聘平台接触员工，安排由冒充 HR 和「CEO」的人主持的面试，然后发来一份「作业代码」让对方下载——而它装着恶意程序。
币安本周公布了初步调查结果。这场行动从 9 月起分阶段推进：另一名工程师在安装一款热门 AI 编程工具时，通过搜索引擎下载了被篡改的 Homebrew 安装包，因而中招。这是最纯粹的供应链攻击——软件是真的，安装包不是。
此后入侵者横向移动，利用被感染的笔记本电脑和公司自己的内部 AI 工具，接触到其他员工并窃取他们的访问凭证。币安称，其终端防护未能检测出这款零日恶意软件，攻击者还替换了合法开发工具的组件并清除了痕迹。
资金转移得很快。区块链分析机构 TRM Labs 测算，10 月 29 日约 63.6 亿美元在 20 分钟内被转走——这是有记录以来最大的加密货币盗窃案，约为 2025 年 2 月 Bybit 被盗 15 亿美元的四倍。
钱包的设计让追回变得更难。币安的热钱包采用多方计算架构，不存在可以简单吊销的单一私钥；攻击者还利用了 EIP-7702——一种允许账户把执行权限委托给合约的机制，把权限交给了他们控制的代码。撤销这些授权需要额外的链上交易，而不是改个密码。
币安表示已重建受影响系统、更换被入侵设备并吊销被盗凭证。截至 11 月 3 日，约 28.5 亿美元已被冻结或拦截；截至 10 月 31 日，98% 的受影响资产已获补充。公司已聘请独立安全机构复核调查结论。
这件事的教训与其说关于加密货币，不如说关于人。最薄弱的环节不是某条曲线或某个密码算法，而是一名以为自己正在求职的开发者，以及一个看起来和其他人下载的完全一样的安装包。
重点词汇
- stage /steɪdʒ/ v. — to arrange an event so that it appears real 安排；上演（假的） They staged interviews with fake executives.
- tampered /ˈtæmpəd/ adj. — changed secretly in order to cause harm 被篡改的 He downloaded a tampered installer.
- supply-chain attack /səˈplaɪ tʃeɪn əˈtæk/ n. — an attack that hides malware inside legitimate software or its distribution 供应链攻击 It was a supply-chain attack in its purest form.
- move sideways /muːv ˈsaɪdweɪz/ phrase — to spread from one compromised machine or account to another inside a network 横向移动 The intruders moved sideways to other staff.
- endpoint /ˈendpɔɪnt/ n. — a device such as a laptop that connects to a network 终端（设备） Endpoint protection missed the malware.
- zero-day /ˈzɪərəʊ deɪ/ n. — a software flaw unknown to the vendor, so no fix exists yet 零日漏洞 The malware exploited a zero-day.
- delegate /ˈdelɪɡeɪt/ v. — to give a right or task to someone else 委托 The account delegated execution rights.
- revoke /rɪˈvəʊk/ v. — to cancel a right or permission officially 撤销 There was no single key to revoke.
- intercept /ˌɪntəˈsept/ v. — to stop something on its way 拦截 $2.85 billion was intercepted.
- replenish /rɪˈplenɪʃ/ v. — to fill something up again after it has been used or lost 补充；补足 98% of assets had been replenished.
阅读测验
共 5 道题目
How did the attack on Binance begin?
What was the second route in?
Binance could revoke the stolen access with a single private key.
Which figures does the article give? (Select all that apply)
The attackers used EIP-7702 to delegate execution rights to a _____.
评论
0 条讨论
登录后发表评论
立即登录暂无评论
成为第一个分享想法的人吧！