Spare a thought for the Binance engineer who, sometime in September, thought he had landed a job interview. Someone posing as a project director contacted him through a legitimate recruitment platform and set him an “assignment” but it contained malicious code. On 29 October, hackers the FBI has attributed to North Korea used that access to walk off with a staggering $6.3 billion in cryptocurrency.
That’s definitely the largest crypto theft on record by some distance because the previous holder of that dubious title, the Bybit hack of February 2025, came to roughly $1.5 billion. Binance chief executive Richard Teng called it “a campaign, built over many months”, though the theft itself reportedly took only around 20 minutes. Binance has since replaced about 98% of the missing tokens from its own coffers so I suppose the €2 worth of Dogecoin I bought back in 2022 for €50 is still okay.
By Sunday night, the next target of a cyber attack was civilian nerves. Ukraine’s Air Alert app, which people rely on to know when to take cover from Russian missiles and drones, began pushing out warnings of radiation, chemical threats and street fighting, partly in error-filled English. Within hours, Russia’s Emergencies Ministry said its own app had been hijacked with users in 33 regions told that nuclear warheads were on the way. President Zelensky later confirmed to PBS news that Ukraine had hacked back: “We only respond on their attacks.”
According to CNN, a war-weary public mostly responded with memes, which may be the most quietly devastating review a disinformation campaign has ever received. On Wednesday the Kyiv Independent had its website and newsletter hijacked to send fake claims to subscribers. Its editor-in-chief Olga Rudenko described it as most likely a Russian operation.
Then Monday morning brought it all home, specifically to the frozen aisle. Thirteen SuperValu stores including branches in Lucan, Blanchardstown, Ranelagh, Bray and Waterford pulled chilled and frozen food after a suspected cyber attack on, of all things, the fridges. Conor Flynn of risk and compliance service provider Waystone told RTÉ it was the first attack of its kind in Ireland, so we can add ‘hacked freezers’ to the list of European trends we got to slightly later than everyone else. Musgraves said the problem was confined to one specific model of fridge and had it resolved by evening. The Minister for Justice was briefed and the National Cyber Security Centre kept watch.
Overnight French supermarkets Delhaize and Carrefour, an Ikea in Belgium and Swedish grocers ICA and Coop all reported freezers mysteriously warming up. Last month in France hundreds of supermarkets had refrigeration units pushed to 50C, spoiling food and even starting fires. The French hacking method, according to BleepingComputer, was to remotely flip Internet-connected refrigeration controllers into defrost mode. Hardly Mission: Impossible … more like someone found the remote control. On Thursday the FBI issued its own alert, noting that attackers had also gone after refrigeration at three foreign blood service facilities. Nobody has claimed responsibility.
So should we just unplug everything? It is tempting. The consumer advice in a Reuters explainer on the attacks pretty much comes close to endorsing this: only connect a device to the wider Internet when there is a clear reason to, it says, because the fewer connected devices you own, the fewer ways in there are for an attacker.
During the Ukrainian app hack, the country’s Centre for Countering Disinformation told people to rely on physical alerts while the problem was fixed. The humble siren has, to my knowledge, never once been phished, so maybe they have a point. Ukraine’s air force also pointed out that the app is separate from its military command systems, which is why a hacked notification didn’t become a hacked defence. Keeping important things apart is about as low-tech as security wisdom gets and it works.
But going fully analogue has its own problems. Musgraves said its monitoring systems were what alerted staff to the problem and allowed them to act immediately. That means the connected technology raised the alarm about the, well, connected technology. An off-the-grid freezer will simply warm up in silence until someone notices the smell. And Ukraine didn’t ditch its app for a bugle either; the app was back up within a day with new alert levels added.
The Binance heist is the hardest to solve with a pair of pliers because no gadget was at fault there – it was good, old fashioned social engineering. In other words, a person was persuaded to trust something or someone they shouldn’t have and you can’t exactly disconnect a human being from its network.
Calling home
The more boring answer is that many of these systems were never really looked after, as Awais Rashid, professor of cyber security at the University of Bristol, told Al Jazeera. He explained that supermarket refrigeration is often managed remotely (frequently by third parties) and doesn’t always get necessary software updates. In Belgium, the director of refrigeration firm Sabcobel told RTL news that the attackers used the same vulnerability as in France but he said most of his clients had adopted the fix since then. In other words, the cure existed and those who applied it seem to have been spared.
Then there’s regulation to think about. The European Commission urged everyone to look to the Cyber Resilience Act, which puts security obligations on the makers of connected products. It’s not glamorous but it’s probably more useful than going back to the ice box.
The lesson here is that nothing is unhackable, but a connected device that’s patched, monitored and kept away from anything important is a lot less hackable than one installed in 2019 and forgotten about. The same goes for humans avoid social hacking: maybe think twice about any recruiter whose coding test seems a little too interesting.
The future of cyber warfare, it turns out, smells faintly of defrosted fish.
Ltd
