Fake recruitment scheme and AI exploit behind $6.3B Binance security breach
An investigation by the cryptocurrency exchange reveals how cybercriminals used compromised staff devices and stolen authentication credentials to infiltrate Binance's digital wallet systems.
What appeared to be a routine coding test from a potential employer turned out to be anything but ordinary. It represented a crucial phase in an elaborate, multi-month cyberattack that culminated in the theft of $6.3 billion from Binance, prompting serious concerns about how cryptocurrency exchanges safeguard themselves from threats that specifically target their workforce.
The security incident represented a sophisticated, coordinated assault that took advantage of both employee susceptibilities and the exchange's internal security infrastructure, as detailed in a comprehensive postmortem analysis published by Binance on Tuesday. The exchange's investigation outlined the methodical approach hackers employed to progressively infiltrate its wallet systems prior to the Oct. 29 security breach.
Based on Binance's security analysis, the attack operation commenced in June, when a member of the engineering team downloaded a compromised software package during the installation process for an AI-powered coding tool. While Binance successfully identified the malicious software and swapped out the infected device, the threat actors had already collected intelligence regarding the exchange's wallet management team.
In September, cybercriminals masquerading as job recruiters focused their attention on a different software engineer and successfully deceived the staff member into downloading a harmful file that was presented as a coding challenge. The malicious software infected the engineer's work device and managed to bypass the exchange's security measures.
On Oct. 20, the cybercriminals leveraged the infected computer along with an internal AI tool to penetrate two more engineers' systems, securing deployment credentials that enabled them to introduce malicious software into Binance's wallet infrastructure on Oct. 29.
The threat actors subsequently obtained access to the exchange's internal wallet-signing service, the system responsible for authorizing cryptocurrency transactions. This access enabled them to transfer funds while circumventing the standard withdrawal procedures.
"This wasn't one mistake or one breach — it was a months-long campaign,"
Binance co-CEO Richard Teng said in a Tuesday post on X.
Binance reported that the cybercriminals additionally took advantage of Ethereum's EIP-7702 mechanism, a protocol feature that permits wallets to delegate transaction permissions to smart contracts, which allowed unauthorized fund transfers to persist even after the exchange halted withdrawals. Its multiparty computation (MPC) wallet system, designed to distribute control over transaction signing across multiple parties, made efforts to revoke those permissions more challenging.
The security incident impacted roughly $6.3 billion worth of digital assets, with Binance stating that $2.85 billion had been frozen or intercepted, based on its most recent calculations. The exchange announced it would shoulder the losses itself instead of transferring them to customers and had restored 98% of the impacted token assets as of Oct. 31.
The security incident, representing the largest cryptocurrency theft on record, has been linked to North Korean hackers by the Federal Bureau of Investigation (FBI). On Tuesday, Kim Yo Jong, the sister of North Korean leader Kim Jong Un, rejected the country's involvement, claiming the FBI's attribution was politically motivated and designed to harm North Korea's international standing.