Binance has disclosed new details about a cyberattack that led to a staggering $6.34 billion loss in digital assets. The FBI has linked the attack to North Korea, which unfolded over several months before culminating on October 29. The attackers initially gained access in June when a Wallet DevOps engineer downloaded a tampered installation of a popular AI coding tool, exposing sensitive information about his colleagues. This breach went undetected until later.
In September, a software engineer at Binance fell victim to a sophisticated phishing scheme. A fake Project Director contacted him through a legitimate job-hunting platform, conducting two rounds of interviews. The second interview involved a purported CEO who sent a malicious file disguised as an assignment. The file contained malware that employed advanced evasion techniques, allowing the attackers to compromise the engineer's computer and replace legitimate development tools with malicious versions.
On October 20, the attackers used the compromised computer to gain control of other engineers' systems. They then logged into a third engineer's computer on October 29, using stolen credentials to trigger a malicious script that executed the attack. Despite suspending withdrawals, Binance reported that some transactions continued due to prior authorizations.
As of November 3, Binance has rebuilt its affected systems, replaced compromised devices, and enhanced its security measures with AI-powered anomaly detection. The exchange has absorbed the financial losses and has already replenished 98 percent of the affected token assets, with efforts ongoing to purchase the remaining illiquid assets.