A Record-Breaking Crypto Theft Built on Ordinary Mistakes
The largest cryptocurrency theft ever recorded cost Binance $6.3 billion, and the group behind it has been linked to North Korea. The operation combined elements of high-tech social engineering—fake job interviews, a virtual meeting staged with a supposed CEO of a shell company, and malicious code disguised as legitimate software—with what researchers describe as remarkably basic human errors.
Artificial intelligence factored into parts of the scheme, yet the attack was far from a science-fiction scenario of autonomous AI agents swarming a target. Instead, it depended on employees who made small, everyday mistakes: clicking a link simply because it sat at the top of a search results page, or trusting a stranger in a video call without spending a few seconds verifying their identity.
Nadav Ziv, a researcher at the Digital Inquiry Group, and Joel Breakstone, the nonprofit's co-founder and executive director, say their decade-plus of studying how people evaluate online information points to two recurring behavioral patterns that leave users exposed. The organization develops free, evidence-based educational materials to help people decide what to trust in an era of phishing, misleading social posts, and AI-generated fakes.
The 'First Result Bias' That Delivered the Malicious Code
According to a Reuters investigation into the hack, the initial breach occurred when a Binance engineer downloaded compromised software after clicking a sponsored search result that ranked higher than legitimate alternatives on the page. That single click introduced the malicious payload into the company's environment.
Ziv and Breakstone note that their research consistently shows internet users tend to treat the top result as the most trustworthy. They click the first link they see, implicitly assuming that a higher placement reflects vetted, reliable content. In classroom settings, students have told the researchers statements such as "Google is almost never wrong" or "AI is always right," surrendering their own judgment to search algorithms or chatbot outputs.
Professional fact-checkers, by contrast, practice what the Digital Inquiry Group calls "click restraint." They recognize that the first result is frequently the organization's own website—hardly a source likely to reveal its own problems—or a page on an open platform like Quora or Reddit where anyone can post unverified information. The recommended habit is to pause, read the short descriptive snippet beneath each link, and deliberately choose a source with genuine expertise or editorial processes, such as a newsroom that employs editors and fact-checkers. The guiding question is simple: who produced this information, and what gives them credibility?
Social Engineering That Leveraged a Polished Social Media Profile
Binance disclosed that it detected the first malicious download, replaced the affected device, and rotated passwords. The operation, however, was not over. A second engineer later downloaded compromised code during what they believed to be a routine job interview. The "interview" included a virtual meeting with the alleged CEO of a nonexistent company.
While it is easy to look back and assume the employee should have spotted the red flags, the researchers caution that bad actors are skilled at making their content feel legitimate. Binance itself reported that its worker was lured by a hacker posing as an HR representative who shared a social media account with the engineer, complete with personal photos and videos posted on the platform, specifically to build a sense of trust.
The Digital Inquiry Group's second recommended habit is what fact-checkers call "lateral reading." Rather than scrutinizing a single piece of content in isolation, fact-checkers open additional browser tabs to check what other credible sources say about the person or entity in question. They understand that a fraudster can easily craft a convincing profile on their own platform, but fabricating a positive reputation across the broader internet is considerably harder.
In practice, this means searching for news coverage, regulatory filings, or independent reports that confirm or contradict the claim you are evaluating. In some cases, the most telling finding is the absence of one: if you look up a company that has reached out to you and discover no external confirmation of its existence, that void is itself an immediate warning sign.
Two Seconds of Verification, Billions in Potential Savings
The researchers stress that the internet and AI have simultaneously made it harder to distinguish authentic content from fabrications and easier than ever to investigate the people and organizations behind online encounters. The tools for verification are already available; the barrier is the willingness to pause.
Had the first Binance engineer practiced click restraint and verified the source before downloading, the malicious code might never have entered the system. Had the second employee taken a moment to seek external confirmation about the supposed HR representative rather than relying on a polished social media profile, the discrepancy might have become apparent before the compromised code was installed.
As Ziv and Breakstone put it, a few seconds of up-front checking can save significant time, distress, and financial loss down the road. In a landscape where even a billion-dollar exchange can be undone by two small human mistakes, that pause may be the most valuable security measure available.
