Binance disclosed details about a cryptocurrency heist targeting $6.34 billion in assets, which the company and law enforcement attributed to North Korean actors. The exchange has successfully frozen or intercepted $2.85 billion of the targeted funds. According to Binance’s investigation, the breach represented the largest sum ever targeted in a cryptocurrency theft and involved a coordinated, multi-stage campaign rather than a single isolated incident.
The attackers began their efforts no later than June and continued through the following Thursday, employing a combination of techniques including social engineering, malicious software, and compromised internal tools. In June, one engineer downloaded a tampered version of Homebrew development software, inadvertently installing malware that provided attackers with information about the engineer’s role and colleagues working on wallet infrastructure. The compromise went undetected initially despite security team awareness of the malicious software.
In September, a second engineer received messages through a job-hunting platform from someone posing as a project director. The attacker conducted fake interviews, first with a purported HR representative and then with a supposed CEO of a fictitious company. During the second interview, the engineer was instructed to download an assignment containing malicious code that executed during setup. The malware used sophisticated obfuscation techniques and evaded endpoint security tools while concealing its activity.
On October 20, attackers leveraged the compromised engineer’s computer and internal AI tools to access two additional engineer devices. Nine days later, they logged into a third device using stolen credentials, deployed unauthorized code, and initiated asset transfers. The attackers exploited Ethereum’s EIP-7702 authorization mechanism to delegate execution rights to attacker-controlled smart contracts, enabling continued fund movements independent of Binance’s normal withdrawal systems. Binance contained further losses by suspending withdrawals and coordinating with partners to freeze affected tokens.
TRM Security identified the attacking group as TraderTraitor and noted that successfully transferred assets were laundered across TRON and Ethereum networks through various methods, including self-minted tokens, lending receipt tokens, and cross-chain swaps using multiple bridges.
Article Attribution | Read More at Article Source
Article summary produced by Claude AI