Months-Long Cyberattack on Binance Leads to $6.3 Billion Theft via Fake Interviews and AI Tools

The breach was part of a carefully coordinated operation that exploited weaknesses in both human behavior and internal security infrastructure, as outlined in Binance’s report released on Tuesday.

Binance’s investigation revealed the attack started in June when an engineer inadvertently downloaded a compromised software package while setting up an AI-based coding tool. Although Binance detected and removed the malware and replaced the infected device, attackers had already collected sensitive information on the exchange’s wallet management team.

In September, attackers impersonated recruiters and targeted another software engineer, tricking them into downloading malware disguised as a coding challenge. This infection bypassed Binance’s security measures and compromised the engineer’s work computer.

On October 20, the attackers leveraged the compromised machine and an internal AI tool to access the systems of two more engineers. They obtained deployment credentials that enabled the installation of malicious software into Binance’s wallet infrastructure on October 29.

The hackers gained control over Binance’s internal wallet-signing service, which authorizes cryptocurrency transactions. This access allowed them to transfer funds without using the exchange’s standard withdrawal process.

Binance co-CEO Richard Teng described the incident as a prolonged campaign rather than a single breach or error, highlighting the complexity and duration of the attack.

The attackers exploited Ethereum’s EIP-7702, a protocol allowing wallets to delegate transaction rights to smart contracts. This enabled unauthorized transfers to proceed even after Binance stopped withdrawals. Additionally, Binance’s multiparty computation (MPC) wallet system, designed to distribute transaction signing authority, complicated efforts to revoke these permissions.

About $6.3 billion in digital assets were compromised, but Binance reported freezing or intercepting $2.85 billion according to its latest accounting. The exchange committed to absorbing all losses itself without passing them to customers, restoring 98% of the affected tokens by October 31.

The FBI has attributed the hack, the largest in cryptocurrency history, to North Korean hackers. However, Kim Yo Jong, North Korean leader Kim Jong Un’s sister, denied any involvement, labeling the accusations as politically driven attempts to harm North Korea’s global reputation.

This unprecedented cyberattack exposes vulnerabilities in employee-targeted security measures at major exchanges, emphasizing the need for enhanced protection against multifaceted threats involving social engineering and advanced technology exploitation.