In its initial report on the security incident, Binance said “attackers spent months working their way into its systems through a supply chain compromise, fake job interviews and an internal AI tool before taking control of hot wallets.”
Key steps in the hackers’ campaign included an engineer on Binance’s wallet infrastructure team downloading a tampered installer while setting up a popular AI coding tool in June; a second Binance engineer being approached on a legitimate job platform and downloading malware that was included in a coding “assignment” during what turned out to be a fake job interview in September; the attackers using the compromised computer to find a container deployment permission on another Binance wallet engineer’s machine on Oct. 20; and the attackers using stolen credentials to deploy a container and launch the attack Thursday (Oct. 29), according to the report.
Binance said in the report that it is keeping some technical details confidential to avoid helping future attackers.
Binance also said that before this attack, its security team had detected and blocked 57 other suspected North Korea-linked threats this year.
“Binance is engaging independent cybersecurity firms to review the incident and validate its findings, increasing investment in AI-based security, and working to set up a security research fund with AI companies and security firms focused on AI security in blockchain,” the company said in the report.
PYMNTS reported Friday (Oct. 30) that this hack of Binance’s exchange was the biggest crypto theft ever.
Following the hack, Binance said its emergency reserve and corporate funds would cover all losses, meaning it would replace customers’ assets.
In a series of updates posted over the weekend, Binance said it was restoring withdrawals in phases after pausing them due to the attack, had covered about 95% of the impacted amount and was sourcing the outstanding 5% of tokens.
In Binance’s initial report on the security incident released Tuesday, the company said that its users are fully covered, as Binance has replenished 98% of the affected token assets and is buying the remaining tokens. The company also said that of the $6.34 billion in digital assets that were affected, about $2.85 billion has been frozen or intercepted so far.
