Binance reports $6.34 billion crypto heist linked to North Korea

Binance has disclosed details regarding a cyber attack that resulted in a $6.34 billion loss in digital assets. The cryptocurrency exchange linked the theft, which occurred on October 29, to North Korea, following findings by the FBI.

The multi-stage attack

According to Binance, the operation was a "sophisticated, multi-stage campaign" that began as early as June. The attack involved several distinct phases:

• June: A Wallet DevOps engineer downloaded a tampered Homebrew installation for an AI coding tool found via a search engine. While Binance detected the anomaly, the event exposed information regarding the engineer's colleagues.
• September: A software engineer was contacted by a "Project Director" on a legitimate job-hunting platform. After two rounds of interviews—one via live video with a purported HR Representative and a second via a chat app with a purported CEO—the engineer downloaded an assignment containing malware.
• October 20: Attackers used the compromised computer and an internal AI tool to gain control of the computers of the Wallet DevOps engineer and another colleague.
• October 29: The attackers logged into a third engineer's computer, used stolen credentials from the first engineer, and triggered a malicious script to launch the attack.

Binance stated the malware "employed sophisticated obfuscation and evasion techniques" and was not detected by endpoint security protection tools at the time.

Financial impact and response

Of the $6.34 billion in digital assets impacted, Binance has frozen or intercepted $2.85 billion. The exchange noted that asset movement continued after withdrawals were suspended because certain transactions had already been authorized.

Specific asset movements included:

• Approximately 970,500 SOL and 44.2 million OP sent to attacker-controlled addresses.
• 18,270 BTC sent to an attacker-controlled address.

Binance said it will absorb the financial losses and has already replenished 98 percent of the affected token assets. As of November 3, the exchange reported it has rebuilt its affected wallet system and internal AI tools, replaced affected devices, and enhanced its system with AI-powered anomaly detection capabilities.

Allegations and denials

The FBI has attributed the attack to North Korea. However, North Korean state news agency KCNA reported that Kim Yo-jong, the sister of North Korean leader Kim Jong-un, called the US assertion "absurd rhetoric" and a "grave political provocation."

---

Sources

• engadget.com: Binance Attackers Used Fake Job Interviews To Pull Off $6.3 Billion Crypto Heist
• arstechnica.com: Binance says hackers who stole billions in crypto spent months planning heist - Ars Technica
• theguardian.com: Hackers behind $6.3bn Binance heist ‘used malware and bogus job interviews’ | Binance | The Guardian

This article was drafted with AI assistance and checked against the sources above. Company claims are reported as claims. Cover image is AI-generated.