Binance revealed details of a sophisticated cyberattack that targeted approximately $6.34 billion in cryptocurrency, marking the largest sum ever targeted in a digital currency theft. The company stated that the perpetrators, attributed to North Korean actors by the FBI and security firm TRM, conducted an extended campaign beginning no later than June. The exchange successfully froze or intercepted $2.85 billion of the stolen assets and indicated it has allocated funds to cover the losses.
The attackers employed a multi-stage approach combining various techniques. Initial compromise occurred in June when an engineer downloaded a compromised version of Homebrew, a software development tool. Later in September, a second engineer received fraudulent job interview solicitations through a legitimate employment platform. The purported recruiter conducted interviews posing as an HR representative and company executive, directing the engineer to download an assignment containing malicious code that infected the device with undetected malware featuring advanced obfuscation methods.
On October 20, attackers leveraged the compromised devices to gain access to additional engineering computers and internal systems. Days later, they used stolen credentials to deploy containers and initiate asset transfers. The theft occurred across multiple blockchain networks, with the attackers transferring approximately 970,500 SOL tokens, 44.2 million OP tokens, and 18,270 bitcoin to addresses under their control. The company detected unauthorized large-volume transfers and immediately initiated containment measures.
The attackers exploited Ethereum’s EIP-7702 authorization mechanism, which permits account delegation without exposing private keys, to maintain unauthorized access beyond Binance’s standard withdrawal infrastructure. They submitted 50 transactions to manipulate account verification sequences and establish malicious delegation permissions. The containment process proved complex due to the hot wallet’s use of Multi-Party Computation technology, requiring specialized procedures to revoke on-chain authorizations. Security researchers tracking the group designated them as TraderTraitor and documented their subsequent asset laundering through TRON and Ethereum networks using various cross-chain swap methods.
Article Attribution | Read More at Article Source
Article summary produced by Claude AI