Crypto exchange Binance on Tuesday published an incident report on the October 29 theft, the largest on record in crypto. According to the report, covered by BleepingComputer and The Hacker News, it was not a single breach or a simple phishing incident but a "sophisticated, multi-stage campaign." The FBI has already attributed the attack to the North Korean group TraderTraitor. Estimates of the amount range from $6.34 billion to $6.43 billion.
The first stage came in June: an engineer on the Wallet DevOps team downloaded a trojanized Homebrew installer while searching a search engine for a popular AI tool. Binance detected the incident and rotated credentials, but information about his role and his colleagues on the wallet team was exposed to the attacker. In September the attacker approached another engineer through a legitimate job-hunting platform, posing as a project director at a fictitious company, and set up two interviews: a video call with an "HR representative" and an interview with a "CEO" on a chat app. At the end, the engineer was told to download an "assignment" from a code repository to his work computer; it contained malware that security tools did not detect.
On October 20 the attacker used the compromised computer and the company's internal AI tool to take control of two more engineers' machines. One of them held a container deployment permission token. On October 29, between 17:15 and 19:56, the attacker deployed a container, ran a malicious script and used access to the internal wallet signing service to send transactions outside the normal withdrawal process.
Binance says it has rebuilt the wallet system in a new environment, rebuilt the internal AI tool and access controls, and tightened device controls. It says it has foiled 57 North Korea-linked cases since the start of the year, including fake job interviews, malware disguised as developer tools and fake video-conferencing apps. What to do: do not run recruiters' "take-home tasks" on work computers, and download developer tools only from their official site.
