The FBI says North Korea was behind the attack.
Binance has revealed more details about the cyber attack that resulted in a $6.34 billion loss in digital assets. The cryptocurrency exchange’s statement linked to the FBI’s findings that North Korea was responsible for the attack and the theft that took place on October 29. It also explained that it wasn’t just a one-day operation for the attackers. In June, a Wallet DevOps engineer working on Binance’s wallet infrastructure downloaded a tampered homebrew installation for a popular AI coding tool that he found through a search engine. Binance was able to detect the anomaly at the time and was able to take action, but the event exposed information on the engineers’ colleagues to the attackers.
Then in September, a software engineer who worked for Binance got a message from a “Project Director” through a legitimate job-hunting platform. He went through two rounds of job interviews, the first of which was on live video with a supposed HR Representative who shared a personal social media account with him to build trust. His second interview was with the purported CEO of the fictitious company conducted through a chat app. The fake CEO sent him an assignment, which he downloaded. Turned out the file had malware in it that was executed during the setup process.
According to Binance, the malware “employed sophisticated obfuscation and evasion techniques” to escape detection. For instance, it replaced an authentic development tool component with a malicious version to execute commands.The malware also concealed its activities and removed traces of the compromise as it went along.
On October 20, the attackers used the compromised computer of the software engineer to use an internal AI tool to gain control of thecomputers owned by the Wallet DevOps engineer and yet another one of his engineer colleagues. Then on October 29, they logged into the third engineer’s computer, used the credentials they stole from the first Wallet DevOps engineer and triggered a malicious script to launch the attack.
Of the $6.34 billion worth of digital assets impacted by the incident, $2.85 billion had been frozen. Binance admitted that the movement of assets continued even after it suspended withdrawals, since those transactions had already been authorized. As of November 3, the exchange has already rebuilt its affected wallet system and internal AI tools, replaced affected devices, decommissioned compromised credentials and tokens, completed enhanced security scans on employee devices and enhanced its system with AI-powered anomaly detection capabilities.
Binance said it will absorb the financial losses from the attack and has already set aside enough to cover the stolen funds. It also said that it has already replenished 98 percent of the affected token assets and “in the process of purchasing the outstanding, more illiquid assets.”