Binance disclosed on Tuesday that the $6.34 billion theft from its cryptocurrency exchange was the result of a prolonged, multi-stage campaign that began as early as June. The company stated that attackers spent months working their way into its systems through a supply chain compromise, fake job interviews, and an internal AI tool before taking control of hot wallets.
Months of Infiltration and Social Engineering
According to the company’s initial report, the breach involved several distinct phases of social engineering and technical exploitation. The first entry point occurred in June when an engineer on Binance’s wallet infrastructure team downloaded a tampered installer while setting up a popular AI coding tool. This initial compromise allowed the attackers to establish a foothold within the company’s network.
The campaign escalated in September when a second Binance engineer was approached on a legitimate job platform. The individual participated in what appeared to be a standard coding assignment during a job interview. The assignment contained malware, which the engineer downloaded, further expanding the attackers’ access. This method of infiltration highlights the growing sophistication of social engineering tactics targeting technical professionals.
The attackers used the compromised computer to identify a container deployment permission on another Binance wallet engineer’s machine on October 20. By October 29, the group had stolen credentials and deployed a container to launch the final attack. The sequence of events demonstrates a patient and methodical approach to bypassing security measures over several months.
Asset Recovery and Security Measures
Binance stated that it is keeping some technical details confidential to avoid helping future attackers. The company noted that before this specific incident, its security team had detected and blocked 57 other suspected North Korea-linked threats this year. This context suggests that the exchange has been actively monitoring for state-sponsored cyber activities.
In response to the breach, Binance is engaging independent cybersecurity firms to review the incident and validate its findings. The company also announced plans to increase investment in AI-based security and is working to set up a security research fund with AI companies and security firms focused on AI security in blockchain.
Following the hack, Binance confirmed that its emergency reserve and corporate funds would cover all losses. The company stated that users are fully covered, having replenished 98% of the affected token assets and buying the remaining tokens. Of the $6.34 billion in digital assets that were affected, about $2.85 billion has been frozen or intercepted so far.
Withdrawals, which were paused immediately after the attack, are being restored in phases. Binance reported that it had covered about 95% of the impacted amount and was sourcing the outstanding 5% of tokens. The exchange emphasized that the emergency reserve ensures no customer will suffer a financial loss due to the theft.
Source: PYMNTS
