Abstract:
Cryptocurrency exchange Binance recently announced the preliminary investigation results of the security incident on October 29. Binance said that after months of preparation, the attackers first used malware, fake recruitment, and Binance’s internal AI tools to gain access to the wallet team, and ultimately gained unauthorized access to the wallet’s signature service and transferred approximately $6.34 billion in digital assets.
Binance stated that all losses will be borne by Binance itself: 98% of the affected token assets have been replenished as of October 31; as of the notification on November 3, approximately $2.85 billion in assets have been frozen or intercepted; the FBI attributed the attack to North Korea-related cyberattacks.
Engineer A was tricked by the Homebrew phishing website on Google:
The investigation showed that in order to install a commonly used AI programming tool, Engineer A of the wallet team searched for the Homebrew keyword through a search engine and clicked on a phishing website paid by the attacker, which resulted in the engineer downloading a tampered Homebrew installation program.
Binance said that its security team had discovered the anomaly at the time, and subsequently replaced the engineer's equipment and rotated relevant credentials. But at this time, the attacker had already learned about the engineer’s job responsibilities and relevant information about his colleagues on the wallet infrastructure team, and the hacker continued to attack in this direction.
The attack dates back to June 2026, but the issues encountered by Engineer A did not have serious consequences. It’s just that Engineer A caused the information leakage of his colleagues on the wallet team, laying the groundwork for subsequent attacks by attackers against members of the wallet team.
Engineer B’s recruitment phishing faked by hackers:
In September, the attacker contacted Engineer B through a formal job search platform. This engineer’s public information mentioned his work experience at Binance. The attackers impersonated project leaders and arranged so-called human resources interviews and company CEO interviews. The attackers also prepared social media accounts, personal photos and videos to build trust.
Towards the end of the second round of interviews, Engineer B was asked to download an assignment on his work computer to be used for job evaluation. This repository executes a malicious program during installation, replacing components of the native development tool pyenv in order to execute commands and connect to an attacker-controlled server.
Binance stated that the malicious program used methods such as obfuscation, evading detection, and erasing traces, and the terminal security tools at the time failed to detect the malicious program. Of course, judging from the results, Binance’s internal security monitoring failed to detect any abnormalities, so this malicious program became a breakthrough point for the attack.
Internal AI tools were used as a springboard and the signature service was compromised:
By October 20, attackers used infected engineer computers and used Binance’s internal AI tools to gain control of the devices of two other wallet team engineers, including wallet team engineer A, who had previously been attacked by the supply chain.
The attacker then discovered that there was a token with container deployment permissions on Engineer A's computer. On October 29, 17:15-19:56 UTC, the attacker logged into the computer of another wallet engineer, used the stolen credentials to deploy the container and triggered the malicious script. The attacker ultimately gained unauthorized access to the internal wallet signing service and initiated the transfer, bypassing Binance's normal withdrawal process.
The asset transfers disclosed by Binance include: 233.46 million XRP, approximately 970,500 SOL, approximately 44.2 million OP, and 18,270 BTC. After Binance claimed that large transfers triggered an internal alarm within the company, Binance launched an investigation and suspended withdrawals. However, the actual situation was that Binance did not initially discover problems with the wallet signature authorization mechanism. As a result, the attacker continued to initiate multiple successful transfers after the anomaly was discovered.
They are all classic scams but Binance engineers did not identify them:
The phishing or social engineering behavior encountered by Engineer A or Engineer B is a classic scam created by hackers in recent years. Pay-per-click phishing websites on search engines should not be used. At least the engineer should install uBlock Origin to block ads on Google search.
The scams encountered by Engineer B are also very common. In recent years, hackers often create fake personas to launch recruitment scams for cryptocurrency companies. Some are to join cryptocurrency companies, while others require job seekers to download malicious warehouses and submit homework. The success rate of hackers is also very high.
It is not appropriate to blame Engineer A and Engineer B here. After all, everyone cannot be required to be a security engineer, but this also seems to indicate that Binance’s internal security training is not in place. At least these classic scams should be taught through internal security training to improve employees’ security awareness.
However, even if Binance hackers create the largest attack in the history of the cryptocurrency industry, it is estimated that other cryptocurrency companies and cryptocurrency engineers will continue to encounter similar scams, and there will definitely continue to be scams by cryptocurrency companies.
Comments