Binance said a fake recruitment process and tampered developer software helped attackers compromise employees over several months before stealing about $6.3 billion in cryptocurrency from a hot wallet on October 29. The exchange detailed the intrusion at a November 3 media briefing, as reported by Reuters and CoinDesk.
Binance said the first compromise began in June, when an engineer installed a tampered Homebrew package while searching for an AI tool. The exchange detected malware and replaced the device, but attackers had already learned about the employee’s role and the wallet team.
In September, a second engineer was approached through a legitimate job platform by people posing as recruiters and company executives. After video interviews, the engineer was asked to download a coding assignment that contained malware. Binance said the attackers later used the compromised device and an internal AI tool to reach two wallet developers’ computers.
On October 29, attackers used one developer’s computer and credentials stolen from another to deploy a container and run a malicious script, Reuters reported. CoinDesk reported that the attackers abused Ethereum’s EIP-7702 feature to gain execution rights over a hot wallet.
The FBI attributed the theft to North Korean group TraderTraitor, an attribution covered in Abijita’s earlier report. Binance has said it will cover customer losses. The breach also triggered billions of dollars in customer withdrawals, detailed in Abijita’s report on the outflows.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
