Binance has published new details on the cyber attack that led to a $6.34 billion loss in digital assets, linked by the FBI to North Korea. The theft took place on October 29 and is being described as the largest financial heist in history.
According to Binance, the operation did not happen in a single day. It began in June and relied on two well-known tricks — a tampered developer tool and a fake recruitment process — rather than a costly zero-day exploit.
How the Binance attack unfolded
In June, a Wallet DevOps engineer working on Binance's wallet infrastructure downloaded a tampered Homebrew installer for an AI coding tool that he found through a search engine, according to Binance. 9to5Mac notes the malware targeted /opt/homebrew, the location used by Homebrew on Apple silicon Macs, so the machine was almost certainly an M-series MacBook. Binance says it detected the anomaly at the time, but the incident still exposed information about the engineer's colleagues to the attackers.
Then in September, a different Binance software engineer was contacted by a "Project Director" on a legitimate job-hunting platform. He went through two interview rounds: a live video call with a supposed HR Representative who shared a personal social media account to build trust, and a chat-app interview with the purported CEO of a fictitious company. The fake CEO sent him an assignment, and the file contained malware that ran during setup, using what Binance called sophisticated obfuscation and evasion techniques.
On October 20, the attackers used the software engineer's compromised computer and an internal AI tool to take control of machines belonging to the Wallet DevOps engineer and another colleague. On October 29, they logged into the third engineer's computer, used stolen credentials and triggered a malicious script.
- $6.34 billion in digital assets impacted; $2.85 billion frozen
