Binance hack: 2 online habits that can help you avoid scams

The biggest heist in the history of cryptocurrencies began with small mistakes made by many Internet users. A hacking group linked to North Korea recently stole $6.3 billion from crypto exchange Binance. The operation was sophisticated, involving fake job interviews and malicious code.

But it was also banal. Although artificial intelligence played a role in this hack, it was not a cyberattack of the future, powered by swarms of AI agents. Rather, it relied on humans making fundamental mistakes, like clicking on a link because it appeared first on a search results page or trusting strangers at a fake company without taking a few seconds to research them.

We work at the Digital Inquiry Group, a nonprofit that studies how people evaluate information online and creates a free, evidence-based curriculum that helps people decide what to trust.

Over more than a decade of research, we’ve found that people frequently engage in online behaviors that make them more likely to be deceived. Two simple strategies can help you better navigate today’s information landscape, from traditional phishing to misleading social media posts to AI fakes. Here’s how.

The Binance heist began when one of the company’s engineers downloaded compromised software. According to Reuters’ investigation into the hack, this engineer clicked on a sponsored search result that appeared higher on the results page and directed them to the malicious code.

Our research at the Digital Inquiry Group suggests that people often behave as if it’s best to start first. They click on the first thing they see. They wrongly associate higher placement with verified content, ceding their judgment to tech company algorithms. Students went so far as to tell us “Google is almost never wrong” or “AI is always right”.

Professional fact-checkers commonly practice click withholding. They understand that whether you’re searching the internet or asking a chatbot, it’s not always best to start first. If you’re researching an organization, the first link will often be to its own site, which is unlikely to disclose anything wrong.

So the next time you search online, be wary of links to sponsored content, the organization you’re investigating, or open platforms where anyone can post and the information isn’t verified, like Quora or Reddit. Read the brief excerpts below each link and make a more informed choice about what to open.

Always ask yourself: who is behind this information? What makes them credible? Look for people and organizations that have direct expertise on the topic at hand or have processes in place to ensure information is accurate, such as media outlets that employ editors and fact-checkers.

Binance claims to have detected the first malicious download, replaced the device and changed passwords. But later, another engineer downloaded compromised code as part of what he thought was a job interview, which included a virtual meeting with the purported CEO of a fake company.

It’s tempting to think that the engineer should have seen something was wrong. But the internet is a precarious place because bad actors know how to make content appear legitimate. Binance claims its employee was tricked by a hacker posing as a human resources representative who “shared a social media account with him, including personal photos and videos posted on the platform, in order to build trust.”

When encountering unfamiliar content, professional fact-checkers don’t just read it carefully: they read laterally. They open new browser tabs to see what other credible sources have to say. Fact-checkers know that bad actors make themselves look good at home, but it’s much harder to fake a good reputation on the internet.

The next time you come across something unfamiliar online, look for authoritative sources that can shed light on the person or organization. You may find a news article that confirms the claim you’re investigating, or a report that identifies a supposedly neutral source as biased.

In some cases, you won’t find anything at all, which is a signal in itself: If you’re looking for a company that has contacted you and can’t find any external confirmation of their existence, that should be an immediate red flag.

If Binance’s first engineer had enforced click restriction and verified the source of the software, he could have avoided the malicious download. If this second employee had taken the time to seek external verification about the supposed HR representative, rather than relying on a polished social media profile, they might have realized something was wrong.

The internet and AI have made it more difficult to determine the authenticity of what we see. They’ve also made it easier than ever to investigate people or things we encounter online. It’s always worth stopping to check. A few seconds in advance can save us a lot of time, heartache and money later.

Nadav Ziv is a researcher at Digital Investigation Group. Joel Breakstone is co-founder and CEO of Digital Investigation Group.