Binance won't say if workers duped into $6.3B mistake will be fired — is keeping them actually the right call?

Though the scheme entailed the use of artificial intelligence — a growing and dangerous trend in the scam world — it also hinged upon human vulnerabilities, as it was through Binance employees that the hackers, believed to be from North Korea, gained access to the company’s systems.

As further details continue to emerge, Binance has stayed mum on whether it will keep the staffers involved on board or let them go over the incident. And, PR experts seem to believe that retaining them may be the right call.

Heist executed through phony job offers and interviews

According to its own initial assessment, posted publicly on Nov. 3, the firm has been subject to dozens of hacking attempts out of North Korea, indicating a “persistent threat by state-sponsored actors targeting the cryptocurrency industry.”

The successful intrusion employed a variety of tactics, primarily “social engineering” that revolved around a fake job offer and numerous imitation interviews that led a Binance engineer to believe they were being poached for a role at another brand.

After the hackers built false rapport with the employee — including through a live video call — the individual was convinced to download a document that they were unaware contained malicious software that allowed the criminals into Binance’s backend interface.

This kicked off “a series of unauthorized activities” that drained the billions from the exchange’s “hot wallets,” which serve as its liquidity pools. Users familiar with crypto have noted that hot wallets (compared to offline “cold wallets”) have certain risks given their continuous online connectivity.

Per the company’s outline of the events, attackers were able to use internal AI to gain control of certain systems and additional devices after leveraging the compromised computer of the prospective interviewee.

Skilled hackers built trust with unknowing targets over time — so should the staff take the blame?

The team says that the incident relied upon extremely “advanced and deceptive social engineering” strategies, ranging from fake video interviews and social media connections, alongside doctored software, to “steal credentials or deploy remote access malware.”

Richard Teng, Binance’s co-CEO, also clarified to media that the attack “did not simply use one engineer’s permissions, and this was not a single ‘one-click’ action.” A statement noted “additional points of breach.”

But, there are some somewhat complicating factors. As reported by Fortune, Binance employees, unless they have public-facing positions, are prohibited from having LinkedIn accounts — which is how the hackers first contacted the worker they pretended to screen for a job (who is not in a public-facing role). Some commenters online are also criticising the employee’s use of a company laptop for prospective job searches.

Ryan McCormick, media relations specialist and co-founder of Goldman McCormick PR, says that, as far as crisis management is concerned, Binance has thus far handled things very well — including as far as the associates involved.

“Binance has described this as a complex attack with no single breach or mistake behind it. Does firing one or more staff members help its reputation here? No,” he told Moneywise.

“The only time that would serve a purpose is if the company’s name were in free fall and customers were completely dissatisfied with every response. At that stage, terminating a few employees becomes a survival strategy, and Binance is nowhere close to that.”