It’s common for scammers to impersonate companies or executives through fake email accounts or social media profiles. But one group of fraudsters decided to take things further by creating an AI-powered “deepfake” of an executive at cryptocurrency exchange Binance.
The scheme targeted Binance’s Chief Communication Officer, Patrick Hillmann, who recounted the incident in a blog post. “It turns out that a sophisticated hacking team used previous news interviews and TV appearances over the years to create a ‘deep fake’ of me,” he wrote.
This allowed the fraudsters to impersonate Hillmann in virtual meetings with cryptocurrency developers. Deepfakes can swap a celebrity’s face over your own, or take existing footage and manipulate the subject's lips to say something else.
In this case, the scammers seem to have used a real-time deepfake of Hillmann during Zoom calls. The Binance executive only learned of the scheme when he began receiving messages from people thanking him about listing their cryptocurrency projects on Binance. “This was odd because I don’t have any oversight of or insight into Binance listings, nor had I met with any of these people before,” Hillmann wrote.
One of the messages then indicated Hillmann was a participant in a Zoom call. In response, Hillmann said “that wasn’t me.” This led him to uncover that fraudsters were using a LinkedIn profile belonging to a fake Binance “listing” employee named Mark J. Marshall. Presumably, the fraudsters were using the since-deleted LinkedIn profile to set up the Zoom meetings with the cryptocurrency developers.
The deepfake of Hillmann was then likely deployed to add legitimacy to the Zoom sessions. “Other than the 15 pounds that I gained during COVID being noticeably absent, this deep fake was refined enough to fool several highly intelligent crypto community members,” Hillmann added.
The incident underscores the danger of deepfake technology entering into the hands of cybercriminals. In June, the FBI warned that scammers were already using deepfakes to impersonate job candidates during interviews for remote positions. This included the use of voice-based deepfakes to secure jobs that had access to sensitive information, including financial records and corporate IT databases at companies.
Hillmann wrote the blog post to warn cryptocurrency developers to be on guard when receiving messages that seem to come from Binance. “Beyond this latest incident, there’s been a recent spike in hackers pretending to be Binance employees and executives on platforms such as Twitter, LinkedIn, Telegram, etc,” he said.
Hillman went on to say the scammers impersonating Binance will offer cryptocurrency developers a chance to list on the exchange, but for a fee, which the fraudsters can steal. Fortunately, there’s an easy way to tell if you’re encountering a real-time deepfake over a Zoom call. Currently, the technology struggles to render fake faces over a person when they turn sideways or place a hand over their face.