Binance Details How Attackers Carried Out Record Crypto Theft
Binance has described how attackers combined malware and a deceptive job interview to carry out what has been reported as the largest cryptocurrency theft to date. In a postmortem, the exchange traced the intrusion to June, when a developer downloaded a tampered installer apparently distributed through a malicious Google advertisement. The download exposed information about Binance engineers and their work.
In September, a second engineer was approached by someone posing as a prospective employer. After several calls and interview rounds, the engineer downloaded what appeared to be an assignment but was malware. Binance says it detected the June infection and replaced the first worker’s device. Its security tools did not detect the later attack, which substituted a malicious version of the pyenv development tool.
Binance says the replacement gave the attackers backdoor access and helped them conceal their activity. By October 20, according to the company, they had used an internal AI tool to gain control over wallets associated with the first engineer and a third employee. The FBI has identified the attackers as a North Korean unit known as TraderTraitor. On October 29, they accessed the third employee’s computer and initiated the theft.
The exchange says it could not quickly revoke authorizations tied to its hot wallet because the wallet used Multi-Party Computation rather than a single private key. Unauthorized transactions continued nearly two hours after the first transfers. Binance says it has frozen or intercepted about $2.85 billion in stolen assets, and its chief executive says customers will not bear the loss.
Chief executive Richard Teng says 98 percent of affected tokens have been replenished, with the remainder pending, and withdrawals have largely resumed. Binance also says it has prevented 57 suspected North Korea-linked cyber threats. Its account leaves open questions about why the interview-based malware succeeded and how the internal AI tool helped the attackers.