Binance has disclosed
further details of a $6.3
billion cyberattack that involved fake job interviews, malicious software
and an internal artificial intelligence tool. The exchange said the campaign
began in June and ended with the theft of digital assets in October.
London’s trading industry is coming home!
According to an
incident report published today (Tuesday), attackers initially compromised an
engineer’s computer through a tampered version of Homebrew, a software package
manager. The employee had downloaded it after clicking an online advertisement
while searching for an AI coding tool.
Hackers Exploited Employee Devices and
Internal AI
Binance detected the
suspicious activity, replaced the employee’s device and changed the affected
credentials. However, the attackers had already gathered information about the
engineer and other members of the wallet development team.
In September, the
hackers approached another engineer through a job-hunting platform. They posed
as representatives of a fictitious company and arranged interviews with
individuals claiming to be its executives. During the process, the engineer
received a coding assignment containing malicious software.
The compromised
devices provided further access to Binance’s internal systems. On October 20,
the attackers used an internal AI tool and information from the compromised
computers to access the systems of two wallet developers.
Binance Hot Wallets Drained Across
Multiple Blockchains
The attack escalated
on October 29, when the hackers used stolen credentials to deploy a container
and run a malicious script. They exploited Ethereum‘s mechanism to obtain
execution permissions over a Binance hot wallet, allowing them to initiate
unauthorised transactions.
The attackers first
moved approximately 233 million XRP from five internet-connected wallets. They
then targeted wallets across multiple blockchains, stealing approximately $6.3
billion in digital assets.
FBI Attributes
Attack to North Korea
The FBI attributed the
attack to
TraderTraitor, a hacking group linked to North Korea. The group has
previously been associated with major cryptocurrency thefts, including the $1.5
billion Bybit hack in February 2025.
North Korea denied
involvement. Kim Yo Jong, the sister of North Korean leader Kim Jong Un,
described the FBI’s attribution as a political provocation.
Binance said it
detected and blocked 57 suspected North Korea-linked cyberattacks in 2026. Many
involved fraudulent recruitment approaches and malicious software.
This article was written by Tareq Sikder at www.financemagnates.com.
