Binance reported that hackers, attributed to North Korea, stole billions in cryptocurrency after months of sophisticated planning. The heist initially targeted $6.34 billion from Binance wallets, the largest sum ever targeted in a crypto theft. The exchange has since frozen or intercepted $2.85 billion of that sum.
Binance said it has set aside funds required to cover the loss and provided a link to a Proof of Reserves page. The attack began no later than June and continued until last Thursday, when attackers compromised an engineer's laptop and withdrew assets from several wallets. The threat actor employed a range of techniques, including social engineering by fake recruitment interviews, malicious software downloads, compromised internal AI tooling, endpoint compromise, and an advanced transaction-authorisation method.
The malware used sophisticated obfuscation and evasion techniques, including replacing a legitimate development tool component with a malicious version. The 0-day malware was not detected by endpoint security protection tools at the time. Attackers also took steps to conceal malicious activity and remove traces of compromise.
On October 20, the attackers used a compromised engineer's computer and an internal AI tool to take control of two other engineer devices. Nine days later, the threat actor logged into a third engineer's device, used stolen credentials, deployed a container, and activated a script to initiate transfers. Among other things, the attackers extended unauthorized access to an internal wallet signing service to complete transactions outside the normal withdrawal process.
Binance said the threat actor was sophisticated and resourceful. Our current investigation indicates that this was a sophisticated, multi-stage campaign, not a single isolated breach or a simple phishing incident.
Source: Ars Technica · Summarized by HeadlinesBriefing