专家向阿纳多卢通讯社表示，从加密货币交易所币安盗取的63亿美元网络盗窃案涉及数月的情报搜集、虚假求职面试和内部人工智能工具的利用，并指出此案疑似有朝鲜参与。
The $6.3 billion cybertheft from cryptocurrency exchange Binance involved months of intelligence gathering, fake job interviews and the exploitation of internal artificial intelligence tools, experts told Anadolu, pointing to suspected North Korean involvement.
这起被称为有记录以来最大规模的加密货币盗窃案，凸显了攻击者如何将操纵员工与技术入侵相结合，以侵入授权数字资产转账的系统。
The operation, described as the largest cryptocurrency theft on record, highlighted how attackers can combine manipulation of employees with technical intrusions to compromise systems authorizing digital asset transfers.
美国区块链分析公司TRM Labs全球政策与政府事务负责人阿里·雷德博德将此案归因于朝鲜，称网络盗窃为受制裁的政府及其武器计划提供了资金来源。
Ari Redbord, global head of policy and government affairs at US blockchain analytics firm TRM Labs, attributed the attack to North Korea, saying cybertheft helps finance the sanctioned government and its weapons programs.
科罗拉多大学丹佛分校信息系统副教授埃尔辛·丁切利表示，此案展示了现代网络攻击背后广泛的侦察和周密策划。虚假招聘打开了进入公司系统的大门根据币安11月3日发布的报告，攻击者最初于6月瞄准一名工程师，当时该员工试图安装一款人工智能编程工具。
Ersin Dincelli, an associate professor of information systems at the University of Colorado Denver, said the case demonstrated the extensive reconnaissance and careful planning behind modern cyberattacks. Fake recruitment opened door to company systems According to Binance's report published Nov. 3, attackers first targeted an engineer in June when the employee attempted to install an AI-powered coding tool.
公司安全团队检测到可疑活动，更换了该工程师的设备和凭证。然而，攻击者已掌握了该员工职责和同事的相关信息。
The company's security team detected suspicious activity and replaced the engineer's device and credentials. However, the attackers had already gathered information about the employee's responsibilities and colleagues.
9月，冒充一家不存在公司招聘人员的人邀请另一名币安工程师参加虚假求职面试。随后的编程任务促使该员工将含有恶意代码的文件下载到工作电脑上，从而使攻击者得以进入公司系统。
In September, individuals posing as recruiters for a nonexistent company invited another Binance engineer to a fake job interview. A subsequent coding assignment prompted the employee to download files containing malicious code onto a work computer, giving attackers access to company systems.
10月20日，攻击者利用内部人工智能工具侵入了另外两名工程师的电脑。10月29日，他们利用从另一名工程师处窃取的凭证部署了恶意软件，并未经授权进入了用于审批交易的内部钱包服务。
On Oct. 20, the attackers used an internal AI tool to help gain access to two more engineers' computers. They deployed malware on Oct. 29 using credentials stolen from another engineer and gained unauthorized access to an internal wallet-g service used to approve transactions.
四分钟内，他们将2.3346亿枚XRP从五个币安钱包转移到他们控制的一个地址。随后的转移包括约970,500枚SOL、4420万枚OP和18,270枚比特币。
Within four minutes, they transferred 233.46 million XRP from five Binance wallets to an address under their control. Subsequent transfers included around 970,500 SOL, 44.2 million OP and 18,270 bitcoin.
币安在检测到异常转账后暂停了提现，但攻击者现有的权限阻止了公司立即阻止所有未经授权的交易。
Binance suspended withdrawals after detecting unusual transfers, but the attacker's existing permissions prevented the company from immediately stopping all unauthorized transactions.
该交易所10月30日表示，该事件的总影响约为63亿美元，与行业合作伙伴的合作帮助在区块链上冻结了约30亿美元的资产。
The exchange said Oct. 30 that the incident's total impact was approximately $6.3 billion and that cooperation with industry partners had helped freeze around $3 billion in assets on the blockchain.
被盗金额大约是2025年2月从Bybit窃取的约15亿美元的4.2倍，后者此前是有记录以来最大的加密货币盗窃案。
The amount stolen was roughly 4.2 times the approximately $1.5 billion taken from Bybit in February 2025, which had previously been the largest cryptocurrency theft on record.
数月的侦察。Redbord表示，按姓名识别钱包工程师、确定谁拥有权限以及了解团队如何协作，都需要数月的研究。
Months of reconnaissance Redbord said identifying wallet engineers by name, determining who heldg authority and understanding how teams worked together required months of research.
他说，职位头衔、专业档案和会议参与情况都可能帮助攻击者识别目标并绘制其职责图谱。
Job titles, professional profiles and conference participation could all help attackers identify targets and map their responsibilities, he said.
他将虚假招聘人员、欺诈性面试和恶意编程任务描述为与朝鲜行动相关的常见手段。工程师可能会认真对待此类方式，因为招聘信息和编程测试看起来是招聘的常规部分。
He described fake recruiters, fraudulent interviews and malicious coding assignments as recurring methods associated with North Korean operations. Engineers may take such approaches seriously because recruitment messages and coding tests appear to be routine parts of hiring.
Redbord表示，该行动从6月的初始入侵到最终盗窃的进展，反映出一场耐心的情报行动，每个阶段都建立在之前获得的访问权限之上。
Redbord said the operation's progression from an initial intrusion in June to the eventual theft reflected a patient intelligence operation, with each stage building on previously gained access.
他建议在独立硬件的一次性虚拟环境中运行外部提供的代码。交易所还应对热钱包设置限额，并对大额转账设置提现上限和延迟，他补充道。
He recommended running externally supplied code in disposable virtual environments on separate hardware. Exchanges should also impose hot-wallet limits, withdrawal caps and delays for large transfers, he added.
Dincelli 表示，经验丰富的工程师依然处于脆弱状态，即使是精密的技术防护措施，也可能在员工不了解利用好奇心、恐惧、紧迫感或其他人类动机的社会工程学策略时被瓦解。
Experienced engineers remain vulnerable Dincelli said even sophisticated technical safeguards can be undermined when employees are unaware of social engineering tactics that exploit curiosity, fear, urgency or other human motivations.
他说，经验丰富的工程师也可能成为此类骗局的受害者，并将币安攻击描述为一项历时数月、精心协调的行动。
Experienced engineers can also fall victim to such schemes, he said, describing the Binance attack as a carefully coordinated operation conducted over several months.
他补充说，开源情报工具和人工智能驱动的自动化技术，使得几乎零成本就能收集信息并构建潜在目标的详细画像。
Open-source intelligence tools and AI-powered automation have made it possible to gather information and build detailed profiles of potential targets at little or no cost, he added.
朝鲜否认责任 FBI 于 10 月 31 日指控朝鲜从币安窃取了 63 亿美元的数字资产，将该行动与被称为 TraderTraitor 的活动联系起来。它敦促加密货币公司屏蔽涉及相关地址的交易。
North Korea denies responsibility The FBI accused North Korea on Oct. 31 of stealing $6.3 billion in digital assets from Binance, linking the operation to activity known as TraderTraitor. It urged cryptocurrency companies to block transactions involving associated addresses.
朝鲜否认了这一指控。领导人金正恩的妹妹金与正指责华盛顿试图将平壤描绘成网络犯罪国家，并暗示美国可能会从为其战略储备追回被盗加密货币中获益。
North Korea rejected the accusation. Kim Yo-jong, the sister of leader Kim Jong-un, accused Washington of attempting to portray Pyongyang as a cybercriminal state and suggested the US could benefit from recovering stolen cryptocurrency for its strategic reserves.
Dincelli 表示，国家支持的网络行动与出于经济动机的犯罪之间的界限正变得越来越模糊。
Dincelli said the distinction between state-backed cyberoperations and financially motivated crime was becoming increasingly blurred.
他说，国家赞助的攻击传统上侧重于间谍活动和地缘政治目标，而朝鲜说明了此类行动也可以用于窃取加密货币并为政府创造收入。
While state-sponsored attacks have traditionally focused on espionage and geopolitical objectives, North Korea illustrates how such operations can also be used to steal cryptocurrency and generate government revenue, he said.