Binance said hackers who stole billions of dollars in cryptocurrency spent months planning the heist and combined social engineering with novel malware, according to a company report released Tuesday.
The report said the attackers began no later than June and continued until last Thursday, when they compromised an engineer's laptop and withdrew assets from several wallets. Binance described the campaign as "a sophisticated, multi-stage campaign" and said it "was not a single isolated breach or a simple phishing incident."
According to Binance, the techniques included a tampered Homebrew installer downloaded by an engineer, and fake recruitment interviews in September. A purported project director arranged interviews with a supposed HR representative and a purported CEO. Binance said the engineer was then told to download an "assignment" that contained malicious code. Binance said the malware was not detected by the endpoint security tools at the time.
Binance said the attackers used compromised devices and an internal AI tool to reach other engineers' systems. On October 29, the threat actor used a stolen credential to deploy a container and start a transfer script, according to the report. Binance said the attackers also gained access to an internal wallet signing service and used Ethereum's EIP-7702 mechanism to give an attacker-controlled smart contract partial execution rights over a Binance hot wallet.
The initial target was $6.34 billion in cryptocurrency from Binance wallets, according to the report. Binance said it has frozen or intercepted $2.85 billion of that amount and has set aside funds to cover the loss. The FBI and the TRM Security firm attributed the heist to North Korean actors, according to the article.
Binance said suspending withdrawals alone could not stop all unauthorized transfers, because the malicious on-chain authorizations operated outside its normal withdrawal system. The company said its hot wallets use Multi-Party Computation, so no single private key could immediately revoke those authorizations, and it needed a specialized procedure to do so.