Binance says crypto thieves spent months planning the heist
An investigation by the Binance cryptocurrency exchange shows the theft, which targeted $6.34 billion, was prepared since June using fake job interviews and new malware. The exchange has so far frozen or intercepted $2.85 billion.
Binance, one of the world's largest cryptocurrency exchanges, said on Tuesday that the hackers who stole billions of dollars in crypto spent months preparing the attack. The US Federal Bureau of Investigation (FBI) and the security firm TRM Security attribute the theft to North Korean actors. The attackers initially targeted $6.34 billion in cryptocurrency from Binance wallets, the largest sum ever targeted in a crypto theft. The exchange says it has set aside funds to cover the loss.
A campaign running since June
Binance says the attackers were active no later than June and successfully took funds last Thursday, after compromising an engineer's laptop. The company stresses that this was a multi-stage campaign, not a single breach or a simple phishing attempt.
In June, one engineer downloaded a tampered version of Homebrew. The security team detected the infected laptop, but only after the attackers had learned the roles of that engineer and his colleagues on the wallet infrastructure team. In September, another engineer was contacted through a legitimate job-hunting platform by someone posing as a project director. Two interviews followed, with a supposed HR representative and a supposed CEO. During the second, the engineer was told to download an "assignment" containing malicious code. This zero-day malware was not detected by the endpoint security tools in place at the time.
How the theft unfolded
On October 20, the attackers used the compromised computer and an internal AI tool to take over two more engineers' devices. Nine days later, between 17:15 and 19:56 UTC, they logged in to the third engineer's device, used a stolen token, deployed a container and ran a script to start the transfers. Hot wallets sent roughly 970,500 SOL, 44.2 million OP and 18,270 BTC to attacker-controlled addresses. The attackers also used Ethereum's EIP-7702 mechanism to give their smart contract partial execution rights over a wallet.
Binance suspended withdrawals and, with partners, froze assets. Because the wallet used Multi-Party Computation (MPC), no single private key existed, so revoking the malicious authorizations required a special procedure. TRM Security says the attackers tried to launder the funds through the TRON and Ethereum networks.
