Binance reported Tuesday that the group responsible for targeting $6.34 billion in cryptocurrency spent months planning the attack. The exchange attributed the sophisticated campaign to North Korean actors, a conclusion shared by the FBI and TRM Security. The incident represents the largest sum ever targeted in a cryptocurrency theft.
The exchange has since frozen or intercepted $2.85 billion of the assets. Binance stated it has set aside funds to cover the remaining loss and provided a link to its Proof of Reserves page. The campaign began no later than June and concluded last Thursday when the attackers successfully compromised an engineer’s laptop and withdrew assets from several wallets.
Social Engineering and Compromised Tools
Binance described the operation as a multi-stage campaign that combined social engineering with novel malware. The attackers used fake recruitment interviews, malicious software downloads, and compromised internal AI tooling to gain access to the company’s infrastructure.
The first known incident occurred in June when an engineer downloaded a tampered version of Homebrew. Although Binance had reported a similar incident in May, the security team only detected the compromised laptop after the malware operators obtained information about the engineer’s role on the wallet infrastructure team.
In September, a separate engineer received messages through a legitimate job-hunting platform. The sender posed as a project director seeking to hire new employees. The purported director arranged a first-round interview with a fake HR representative and a second-round interview with the supposed CEO of a fictitious company.
During the first interview, the fake HR representative shared a social media account containing personal photos and videos to appear legitimate. The second interview took place over a social chat app. The engineer was instructed to download an assignment that linked to a code repository containing malicious code. This code executed on the engineer’s device during the setup process.
The malware used sophisticated obfuscation and evasion techniques. It replaced a legitimate development tool component with a malicious version to execute commands and establish communication with an attacker-controlled server. The 0-day malware was not detected by endpoint security protection tools at the time. The attackers also took steps to conceal their activity and remove traces of the compromise.
Exploiting EIP-7702 and Multi-Party Computation
On October 20, the attackers used the compromised engineer’s computer and an internal AI tool to take control of two other engineer devices. This included the device previously targeted with the trojanized Homebrew installer. That engineer’s wallet contained a token granting access to a container deployment.
Nine days later, between 17:15 and 19:56 UTC, the threat actor logged in to the third engineer’s device. They used the stolen credential to deploy a container and activate a script to initiate the transfer. The attackers extended their unauthorized access to an internal wallet signing service to complete transactions outside the normal withdrawal process.
Binance hot wallets on Solana and Optimism sent approximately 970,500 SOL and 44.2 million OP to attacker-controlled addresses. The exchange also sent 18,270 BTC to an attacker-controlled address.
The attacker then used the signing service to exploit Ethereum’s EIP-7702 authorization mechanism. This mechanism allows an account to delegate certain execution rights to a smart contract without exposing the private key. The attackers used this method to give an attacker-controlled smart contract partial execution rights over a Binance hot wallet.
Binance immediately initiated multiple containment measures. These included suspending withdrawals to restrict further outflows, coordinating with partners to freeze affected tokens, and taking steps to revoke unauthorized permissions. These efforts froze a total of $2.85 billion in assets.
Suspending withdrawals alone could not stop all unauthorized asset movements. The malicious EIP-7702 authorizations existed on-chain and operated independently of Binance’s normal withdrawal infrastructure. The attackers submitted 50 signing transactions to manipulate the account nonce and establish malicious delegation authorizations. Once established, these authorizations enabled the attackers to continue moving assets independently of Binance’s normal withdrawal infrastructure.
The containment process involved additional technical complexities. Because the hot wallet used Multi-Party Computation (MPC), there was no single private key that could be used to immediately revoke the malicious EIP-7702 authorizations. The team developed and executed a specialized procedure to revoke these authorizations, which required additional time. Furthermore, suspending withdrawals and shutting down hot wallet services did not automatically invalidate existing on-chain authorizations.
TRM Security noted that the attackers used various means to launder successfully transferred assets through the TRON and Ethereum blockchain networks. The methods included a self-minted token and liquidity pool, a lending receipt token passed between wallets, and cross-chain swaps chained through two bridges. TRM is tracking the North Korean hacking group under the name TraderTraitor.
Source: Ars Technica
