Key facts
- Binance said hackers targeted $6.34 billion in cryptocurrency from its wallets and it froze or intercepted $2.85 billion.
- Binance said the campaign began no later than June with a tampered Homebrew download on an engineer's laptop.
- A September fake interview led an engineer to download malicious code that endpoint security tools did not detect, Binance said.
- Binance hot wallets on Solana and Optimism sent approximately 970,500 SOL and 44.2 million OP to attacker addresses.
- A Binance hot wallet sent 18,270 BTC to an attacker-controlled address, the company said.
- The FBI and TRM Security attributed the heist to North Korean actors, with TRM tracking the group as TraderTraitor.
Hackers who targeted $6.34 billion in cryptocurrency from Binance wallets spent months planning the theft, using fake job interviews, malware and compromised internal AI tooling, the exchange said in a report on its investigation, according to Ars Technica. Binance said it has frozen or intercepted $2.85 billion of the sum and set aside funds to cover the loss.
The company said the campaign began no later than June, when an engineer downloaded a tampered version of Homebrew. In September, a second engineer was approached through a legitimate job-hunting platform by someone posing as a project director, and during a second interview was instructed to download an assignment that contained malicious code. Binance said the malware was not detected by endpoint security tools at the time.
On October 20, the attackers used a compromised engineer's computer and an internal AI tool to take control of two other engineer devices. Nine days later, between 17:15 and 19:56 UTC, they logged into a third engineer's device, used a stolen credential to deploy a container and activated a script to initiate transfers, Binance said.
Binance hot wallets on Solana and Optimism sent approximately 970,500 SOL and 44.2 million OP to attacker-controlled addresses, and a hot wallet sent 18,270 BTC, the company said. The attackers also used Ethereum's EIP-7702 authorization mechanism to give an attacker-controlled smart contract partial execution rights over a Binance hot wallet, submitting 50 signing transactions to manipulate the account nonce, Binance said.
Binance said suspending withdrawals could not stop all unauthorized movements because the malicious authorizations existed on-chain, and that the hot wallet's use of Multi-Party Computation meant no single private key could immediately revoke them. The FBI and TRM Security attributed the heist to North Korean actors, with TRM tracking the group as TraderTraitor and saying the attackers laundered assets through the TRON and Ethereum networks.