Binance has detailed how a sophisticated, months-long campaign, beginning with a malware download in June, culminated in the $6.3 billion cryptocurrency heist. The exchange revealed that hackers exploited a series of security breaches, including a recruitment scam involving bogus job interviews, to gain access to its systems.
The breach began when a Binance engineer inadvertently downloaded malware while attempting to install a popular AI coding tool. This initial compromise exposed the engineer's role within the team responsible for managing Binance's cryptocurrency wallet infrastructure. Although Binance's security team detected the anomaly and replaced the engineer's device, the hackers had gained valuable intelligence about the team's operations.
In September, the attackers escalated their efforts by initiating a recruitment scam. A different Binance engineer was approached on a job-hunting platform by an individual posing as a project director. This led to a series of interviews, including a video call with a fake HR representative and a subsequent interview via a chat application with an individual claiming to be the CEO of a fictitious company. During the second interview, the engineer was tricked into downloading a malicious code repository onto their work computer.
On October 20, the attackers utilized the compromised computer and an internal AI tool to gain control of the systems belonging to the engineer who downloaded the malware and another wallet developer on the same team. Nine days later, on October 29, the hackers used the second developer's computer, leveraging credentials stolen from the first engineer, to trigger a malicious script and execute the attack, draining billions of dollars in crypto assets from Binance's hot wallets.
The FBI has attributed the heist to North Korea's state-sponsored hacking group, TraderTraitor. North Korea has denied these accusations, with Kim Yo Jong, the sister of leader Kim Jong Un, calling the U.S. claims "absurd rhetoric."
Binance stated that it has reserved over $6.34 billion of company funds to cover customer losses and is working with partners to recover affected assets. The exchange has also committed to repaying all customers who were victims of the cyber heist. The company is increasing its investment in AI-enabled detection systems and engaging third-party cybersecurity experts for further review of the incident.