A hacking group tied to North Korea stole $6.3 billion from Binance, the cryptocurrency exchange, in what researchers say began with routine online mistakes.
One Binance engineer downloaded malicious software after clicking a sponsored search result that appeared high on a results page. A second engineer later downloaded compromised code as part of what they believed was a job interview with a fake company's CEO. Binance says it caught the first download, replaced the device, and changed passwords. The hacker posing as an HR representative built trust by sharing a social media account with personal photos and videos.
Researchers at the Digital Inquiry Group, a nonprofit that studies how people evaluate online information, identify two habits that could have prevented the breach.
Click restraint means avoiding the assumption that first results are best. Sponsored links, a company's own website, and unverified platforms like Quora or Reddit often appear at the top of search results but may not provide trustworthy information. Fact-checkers read the snippets beneath links before deciding what to open.
Reading laterally means opening new browser tabs to verify claims about unfamiliar people or organizations through external sources. Bad actors can construct convincing profiles on their own sites, but creating a credible reputation across the internet is harder. If you search for a company that contacted you and find no external confirmation it exists, that signals a red flag.
The researchers note that "a few seconds up front can save us all a lot of time, grief and money later on."