Binance, one of the world’s largest cryptocurrency exchanges, suffered a staggering $6.34 billion heist last week, marking the biggest cyberattack on the crypto industry to date. The breach, attributed to North Korean hackers, unfolded in just 20 minutes after months of meticulous planning. According to Binance’s security update, the attack began when an engineer fell for a fake job interview and unknowingly downloaded malicious software. This allowed hackers to infiltrate the company’s network, exploit an internal AI tool, and access a wallet signing service, bypassing normal withdrawal procedures.
The hackers, linked to the notorious TraderTraitor group, exploited multiple vulnerabilities within Binance’s systems. The FBI confirmed the attack’s connection to North Korea, noting that the hackers had been preparing since June. Binance revealed that the attackers compromised three engineers, using stolen login details and malware to gain control over critical systems. The theft spanned more than 10 blockchains, with nearly half of the stolen funds frozen by the crypto industry, leaving billions still in the hackers’ control.
Security experts, including Rafe Pilling of Sophos, highlighted the sophistication of the attack, emphasizing that the hackers did not simply steal wallet keys but systematically compromised engineers to understand and manipulate Binance’s operations. The stolen funds are now being laundered through complex methods, involving thousands of wallets and transactions across multiple blockchains. If successful, the money could potentially fund North Korea’s nuclear and missile programs, according to previous reports.
Binance has apologized for the breach and assured users that it has set aside funds to cover the losses. The company has also rebuilt or replaced impacted systems, though the investigation is ongoing. The incident underscores the persistent threat posed by state-sponsored cybercriminals to the cryptocurrency industry.