According to Binance, the largest cryptocurrency theft to date was achieved by combining a few well-known hacking techniques over the course of a few months. A postmortem of the company says the process began in June when a developer downloaded a manipulated installer apparently spread by a malicious Google ad, exposing details about the engineers and how they work. Then, in September, another engineer was attacked by someone who claimed to be interested in hiring him; that person arranged a series of calls and multiple rounds of interviews, shared social media pages to build trust, and eventually asked them to download a fake interview task that was actually malware.
Binance claims that its security teams detected the first malware installation in June and replaced the worker’s device, but that its security tools did not detect the second attack that removed the pyenv executable and replaced it with a malicious version that gave them backdoor access:
The malware employed sophisticated obfuscation and evasion techniques, including replacing a legitimate development tool component with a malicious version to execute commands and establish communication with an external server controlled by the attacker. Endpoint security protection tools did not detect 0-day malware at that time. The attacker also took steps to hide the malicious activity and remove traces of the compromise, making detection and subsequent investigation difficult.
According to the story, on October 20, the attackers, whom the FBI has identified as a North Korean unit dubbed “TraderTraitor,” used Binance’s own internal AI tool to gain control over the wallets of the first engineer compromised in June, as well as a third employee, before logging into the third employee’s computer on October 29 and launching their attack.
The postmortem also explains why Binance was unable to stop the transactions that occurred nearly two hours after the first unauthorized transfers, saying that “because the hot wallet used Multi-Party Computing (MPC), there was no single private key that could be used to immediately revoke the malicious EIP-7702 authorizations.” Binance says it has prevented 57 suspected cases of cyber threats linked to North Korea, and CEO Richard Teng writes that no users are enduring the loss, with around $2.85 billion in stolen assets frozen or intercepted: “At this time, 98% of affected tokens had been replenished; we are completing the remaining 2%. Withdrawals have largely resumed.”
What’s less clear is why this particular attack worked: There have been warnings for years about the danger of job interviews that ask people to download and run code on machines with access to the employer’s material, and there are few details about the “internal AI tool” the attackers used and why it was able to help them in the first place.
