This is Binance/CZ's version of the story, but no one really knows the truth.

They have a massive incentive to invent a story to cover up the incident. I'm not saying it's a cover-up, but the motive is definitely there.

North Korea has denied responsibility, whereas they usually own up to their actions.

Disregarding that, it just doesn't make sense for their internal security to be so lax.

I've worked at big companies but with AUM lower than Binance, a lot of control and safeguards are in place to prevent one "rogue" employee from stealing everything.

It's pretty much impossible for a company like Binance to not have implemented such things. I do not buy it.

It's getting really confusing with these online job offers, including interviews and assignments. Various people are pretending to be recruiters. I've basically stopped answering phone calls, and everything goes to voicemail unless the caller is in my contacts. But that is hard to do if you are looking for a job. Honestly, if you are the target of this type of campaign, as described in this article, there is probably a good chance you will get compromised, even if you are normally careful.

Just want to highlight I came across one of these fake interviews last year and it unnerved me how close they came to succeed. I thought alot of about it and I realised they must have planned and been "coached" by a frontier LLM on how to go about social engineering me. This was a year ago! I can only shudder at their abilities now. It didnt work, but it was the closest attempt I'd ever witnessed.

Dont trust anything anymore.

I'm just a simple programmer from the Santa Cruz Mountains but how is it possible to withdraw that much money without scrutiny? I mean if I go to my bank and want to my hypothetical millions in cash they'll say "It'll take us awhile to collect that much cash and meanwhile the government requires us to ask you a few questions about what you're doing..."

Founder of Callstrike here .. we build real time deepfake & voice impersonation attack simulation tools for a living so this is literally what I deal with every day.

The biggest irony is that we get at least a couple of signups every month from South Korea, Russia, India, Nigeria just to try getting access to our platform for running these attacks ..

Here is the most recent copy paste from a Calendly invite ..

>Invitee Email: >ashley@cairnsovereign.net

>Invitee Time Zone: >Central European Time

>Questions:

>Please share anything that will help prepare for our meeting.

>We are an MSP from the UK that is look for a deepfake platform to run campaigns for our clients. We typically use open source software but there is a gap in our portfolio for deepfake testing that we can't fill with our usual open source philosophy.

The company website https://www.cairnsovereign.net/ was registered just 2 days ago .. they have no linkedin presence, fake CEO and fake CTO and fake everything ..

I still accepted the invite and joined and the person has a strong northern british accent .. he askd me to let his AI bot join the call to take notes ... i refused .. to which he swore and said that if a meeting bot is not allowed .. then i dont want to talk and abruptly hung up ...

PS: if anyone wants to see .. this is what a real time voice impersonation call and real time deepfake faceswap .. looks like ..

https://www.callstrike.ai/deepfake-security-training

https://www.callstrike.ai/voice-phishing-simulator

Binance is one big scam! They said they'd reimburse affected customers but I'm convinced they just took other customers crypto to fill those wallets. There's no way Binance could survive a $6 billion heist.

Further evidence that 1) recruiting is broken and 2) developers make great targets, and we need to respond accordingly.

If you want to learn more about the Lazarus group behind this heist, the BBC did an excellent podcast on another one of their operations:

https://www.bbc.com/audio/series/w27vqd03

(It's also on Spotify, Apple Podcasts etc)

Crack down on fake job postings. It might not have stopped this attack, but it would have made it a lot harder for it to hide among all the terrible postings desperate people spray-and-pray at because they wouldn't exist because they'd be illegal.

So, North Korea is involved in hits not unlike some Russians do. But at the same time it may provide a cover for other state actors. May be unlikely in this case (I think the pattern here is making it indeed most likely that North Korea is responsible, it just fits so much; for similar reasons, it was very clear that Marsalek worked for the FSB and stole a lot of money from europeans https://en.wikipedia.org/wiki/Jan_Marsalek), but it should be kept in mind.