On October 3, cryptocurrency exchange Binance disclosed the initial findings of the approximately $6.34 billion (about 1 trillion yen) crypto asset outflow incident that occurred on September 29.
According to the investigation, the attack was a multi-stage operation involving fake job interviews, malware, and the exploitation of internal AI tools.
The company reported that the initial attack seemed to have occurred in June this year. A wallet engineer downloaded a tampered Homebrew installer via a search engine while implementing an AI coding tool. Although Binance detected the anomaly and replaced the device, the attackers had already gained insights into the wallet team's structure.
In September, another engineer was contacted through a legitimate job site by an individual posing as a project manager. During an interview with someone claiming to be the CEO of a fictitious company, the engineer was instructed to download a repository containing malicious code onto a work PC as a "task." This led to an infection with malware that the security tools at the time could not detect.
On the 20th of last month, the attackers leveraged the compromised devices and internal AI tools to take control of the terminals of two wallet engineers. They stole tokens with container deployment privileges and executed unauthorized scripts on the 29th.
Moreover, by exploiting Ethereum's "EIP-7702," they set unauthorized delegations on the hot wallet, allowing some asset movements to continue even after withdrawals were halted. As of September 30, Binance executed a new authorization to a zero address from the affected hot wallet, effectively revoking the unauthorized delegations.
On the 31st of last month, the FBI (U.S. Federal Bureau of Investigation) announced that the incident was perpetrated by the North Korean hacker group 'TraderTraitor.' The stolen assets were primarily converted into Ethereum (ETH), prompting a call for crypto-related businesses to block transactions with related addresses.
In response, North Korea denied involvement through a statement by Kim Yo-jong, the sister of General Secretary Kim Jong-un. According to the Korean Central News Agency, North Korea condemned the FBI's announcement as a 'serious political provocation.'
Binance explained that it successfully froze or prevented the movement of approximately $2.85 billion (about ¥453 billion) of the outflow. Additionally, as of the 31st of last month, Binance had replenished 98% of the affected assets.
On the 3rd, Binance added networks and assets for withdrawal resumption. It emphasized that user activity is improving and cash flow is stabilizing, with deposit amounts sometimes exceeding withdrawals.
Reference: Binance Announcement
Image: Shutterstock
Binance Estimates Hacking Losses at Approximately $6.3 Billion, Engineer's PC Breach Suspected
Binance May Have Lost Over ¥900 Billion in Crypto, Bitcoin and Others Plunge
