Binance has detailed the $6.34 billion crypto heist, tracing it to North Korea via FBI findings. The attack, spanning months, began in June when a Wallet Dev Ops engineer downloaded a malicious AI tool, exposing credentials. In September, a software engineer received a fake job offer via a hiring platform, passing live video interviews with a fake HR rep and CEO before downloading malware-laced code.
The malware evaded detection through obfuscation and replaced legitimate tools to execute commands. On October 20, attackers accessed a compromised engineer's device using an internal AI tool, then on October 29 used stolen credentials to trigger the breach. $2.85 billion of assets were frozen, though movement continued post-withdrawal suspension. Binance rebuilt systems, replaced devices, revoked compromised tokens, and enhanced security with AI anomaly detection.
The company absorbed losses, set aside full coverage, replenished 98% of tokens, and is purchasing remaining illiquid assets.
Source: Engadget · Summarized by HeadlinesBriefing