Binance Says Hackers Used Well-Known Tricks to Carry Out a $6.34 Billion Heist - WIRED
Cryptocurrency exchange Binance was compromised in a $6.34 billion hack last week, with North Korean hackers using a fake job interview to infiltrate the company's systems.
For almost a decade, North Korean cybercriminals have targeted the cryptocurrency industry, but last week's heist stands out as their largest yet. Hackers siphoned $6.34 billion from Binance wallets in just 20 minutes, according to the exchange's security update published on Tuesday. The breach resulted from an engineer falling for a fake job interview and downloading malicious software, allowing attackers to move through Binance's network, exploit an internal AI tool, and access wallet signing services.
This should not have happened, and we apologize for the concern, disruption and uncertainty it caused our users, partners and the wider industry.
Binance emphasized that it was not a single isolated breach or a simple phishing incident and has set aside funds to cover losses while rebuilding affected internal systems. Although more than $6 billion was stolen, nearly half has been frozen by parts of the cryptocurrency industry, though billions remain under the hackers' control as they attempt to launder the funds.
North Korean Connection
Multiple cryptocurrency tracing firms quickly attributed the attack to North Korea's sophisticated TraderTraitor group, which previously stole over $1.5 billion in a separate hack last year. The FBI officially linked TraderTraitor to the Binance hack on October 31. Binance's analysis revealed the hack was months in the making, with activity first traced back to June when Engineer A downloaded a tampered Homebrew installation from an online search.
In September, another Binance engineer, Engineer B, was contacted through a legitimate job-hunting platform and attended a video interview with a fake recruiter who shared authentic-looking social media accounts and photos. During a second-round interview conducted via online chat, the engineer was instructed to download an 'assignment' containing malicious code onto their work computer.
The attackers didn't simply steal a wallet key. They compromised engineers, used that access to understand and move through the environment, and ultimately subverted the systems used to authorize transactions.
Attack Execution
The attackers used their access to Engineer B's machine to gain control over Engineer A's wallet and another wallet belonging to Software Engineer C. By October 29, they logged into Engineer C's computer using stolen credentials and launched the attack. The hackers exploited unauthorized access to an internal wallet signing service to initiate transactions outside normal withdrawal procedures.
Sophos's Rafe Pilling noted that TraderTraitor excels in detailed planning and understanding how victim services operate. The initial compromise is just a foothold, he explained. The real attack is carefully engineered around how the victim actually moves money.
Money Laundering Efforts
Security experts report the hackers are now attempting to launder the stolen cryptocurrency, a process that could take months. Since 2017, North Korean-linked hackers have stolen approximately $12 billion in cryptocurrency, with more than half of that coming from this year's heists. Crypto tracing firm Elliptic described the laundering from the Binance attack as highly complex and likely automated.
In the first three and a half days after the hack, the hackers used about 12,000 wallets across 11 blockchains—roughly one new wallet every 25 seconds—and conducted more than 40,000 transactions. If successfully laundered, the funds could be converted to cash to bolster North Korea's nuclear weapons program and ballistic missile systems, according to the Multilateral Sanctions Monitoring Team.
Related
