The $6.3 Billion Heist That Started With a Job Offer
Last week, attackers stole $6.3 billion from Binance, the world's largest cryptocurrency exchange. It is likely the largest financial heist on record. You might expect a theft that size to involve some brilliant technical exploit. It didn't. It started with a job offer.
Your firm doesn't hold crypto, but this story still matters to you. The tactics behind it work just as well against a law firm, and attorneys are some of the easiest people to approach with a convincing recruiting pitch.
How It Happened
Binance's co-CEO described the attack as a campaign built over many months, and the FBI has attributed it to North Korea (CoinDesk). According to the company's own account, it unfolded like this:
June: An engineer searched online for a popular AI tool and installed a tampered version. Binance caught it and replaced the device, but the engineer's team had already been exposed.
September: A software engineer was contacted through a legitimate job platform by someone posing as a project director. A fake HR representative interviewed him by video and shared a social media account with personal photos to build trust.
The "assignment": After a second interview with a supposed CEO, the engineer was told to download a coding assignment onto his work computer. It contained malware that slipped past the company's endpoint security.
October 20: Using that compromised laptop and one of Binance's own internal AI tools, the attackers reached the computers of two more engineers.
October 29: With stolen credentials, they moved the money out over roughly four hours.
Binance said it had blocked 57 suspected North Korea-linked attempts this year. It only took one that worked.
Why Attorneys Should Pay Attention
Few professionals get more recruiter outreach than attorneys. Lateral moves are a normal part of legal careers, and a message from a headhunter about a great opportunity is routine. That makes the Binance playbook easy to adapt to a law firm.
Picture a LinkedIn message about a partner-track role at a growing firm. A friendly video call follows. Then comes a request to review a "writing sample prompt," a "conflicts questionnaire," or a "compensation summary." Each step feels normal. One download on a firm laptop is all it takes.
The Binance attackers were patient. They built rapport over weeks and used realistic profiles and photos. A busy associate or partner checking messages between meetings is exactly the kind of target this approach is designed for.
The AI Tool Nobody Approved
The second lesson is quieter but just as important. One of the first footholds came from an engineer who searched for an AI tool and installed a fake version (CNBC).
The same thing is happening in law firms right now. Attorneys and staff are trying AI tools for drafting, research, and summarizing, often on their own. A search, a convincing download page, and a fake installer can put malware on a device that holds privileged client files.
AI also helped the attackers once they were inside. Binance said they used the company's own internal AI tools to reach other accounts. Every AI tool connected to firm systems is another door that needs a lock.
What Law Firms Should Do Now
Treat recruiter outreach as a risk. Remind attorneys and staff that unsolicited job offers are a known attack method. Never open "assignments," forms, or files from a recruiter on a firm device.
Keep personal and firm activity separate. Job searching, personal downloads, and side projects belong on personal devices, not firm laptops.
Control what gets installed. Maintain a list of approved AI tools and software, and restrict who can install anything else.
Limit what one device can reach. If a single laptop is compromised, least-privilege access keeps the damage contained to a few files instead of the entire document system.
Don't rely on antivirus alone. The Binance malware got past endpoint security. Layer in monitoring that can spot unusual activity after an attacker is already inside.
Train for the long con. Most awareness training focuses on suspicious emails. Today's attackers build relationships over weeks, so training should cover patient, personalized approaches too.
Know Where You Stand Before Someone Tests You
Binance had a large security team, endpoint protection, and advanced wallet safeguards. It still lost billions because attackers found one person to trust them and one tool nobody had vetted. Most law firms have far fewer layers of defense, and they hold information that is just as valuable to the right attacker.
At Shield IT Networks, we provide Evidence-Based Security & Accountability. We work alongside your existing MSP or IT team to find the gaps attackers look for, from unvetted software to overly broad access, and give you documented proof of what has been fixed.
Find out how your firm would hold up. Book a Cyber Readiness Assessment today.
Comments