Binance has released a report that reconstructs in detail the theft of approximately 6.34 billion dollars in digital assets, which occurred on October 29 and is considered the largest ever recorded in the crypto sector. According to the exchange, the operation is the result of the combination of already known techniques, carried out over the course of a few months between social engineering, malware and compromise of internal systems. The FBI attributed the attack to the North Korean group TraderTraitoralso charted as Lazarus Group, Jade Sleet and APT38.
The chain of events reportedly began in Junewhen a developer downloaded a tampered installerprobably spread via a malicious Google ad. This would have exposed information about the company’s engineers and how they work. Binance says its security teams detected that first infection and replaced the affected employee’s device.
In September another software engineer was contacted through a legitimate job search platform from a person posing as a Project Director of a non-existent company. The target’s profile cited his experience at Binance, which made him particularly attractive. The fake recruiter arranged two interviews. In the first, over a video call, an alleged human resources representative shared a social account with personal photos and videos to build a relationship of trust. In the second, carried out on a well-known chat application, an interlocutor who introduced himself as CEO has asked the candidate to download a programming exercise from an online repository.
The repository contained malicious code which, once executed, has infected your device with custom malware never seen before and not detected by antivirus. As explained by Binance: “The malware employed sophisticated obfuscation and evasion techniques, including replacing a legitimate component of a development tool with a malicious version, to execute commands and establish communication with an external server controlled by the attackers. The 0-day malware was not detected by endpoint protection tools at the time. The attacker also took steps to hide the malicious activity and remove traces of the compromise, making detection and subsequent investigation more difficult.”
On a technical level, the script created in the Homebrew installation directory on macOS an executable called pyenv_. It then deleted the original pyenv, renamed the malicious file to pyenv, and modified its symbolic link, using it to launch a Z shell (zsh) process. This replacement allowed for execute commands sent by the attackers’ server and gain backdoor access.
By October 20th the criminals, exploiting a compromised computer and an internal AI tool at Binance, they have reached two other employees involved in the wallet infrastructureobtaining credentials and a deployment token per container. On October 29, by accessing the third employee’s computer, the attackers distributed a malicious script and obtained unauthorized access to the wallet signing servicetransferring large amounts of cryptocurrencies across multiple blockchains.
The attackers also have abused Ethereum’s EIP-7702 authorization mechanismwhich allowed them to continue to siphon funds even after the exchange suspends withdrawals. Binance explains why it was not possible to stop the transactions that occurred almost two hours after the first unauthorized transfers: “Since the hot wallet used Multi-Party Computation (MPC), there was no single private key that could be used to immediately revoke the malicious EIP-7702 permissions.”
Binance reports that it has rebuilt the affected systems, replaced the compromised devices, and revoked the stolen credentials.
CEO Richard Teng reiterated that no user will suffer losses: “At this time 98% of the affected tokens have been reinstated; we are completing the remaining 2%. Withdrawals have largely resumed.” The exchange also says it has prevented 57 cases of cyber threats suspected of links to North Korea, is continuing its investigation and has brought in independent security firms to review its findings.
