Binance has revealed that hackers who stole billions in cryptocurrency spent months planning the heist, combining social engineering and novel malware. The attack, attributed to North Korean actors by the FBI and TRM Security, initially targeted $6.34 billion from Binance wallets. The exchange has since recovered or frozen $2.85 billion of that amount, with Binance setting aside funds to cover the remaining loss.
The hackers began their campaign no later than June, culminating in the compromise of an engineer’s laptop last Thursday. Binance described the threat actor as sophisticated, using techniques like fake recruitment interviews, malicious software downloads, and compromised internal AI tools. The first sign of compromise occurred in June when an engineer downloaded a tampered version of Homebrew, though the security team only detected the malware after the attackers gathered information about the engineer and his colleagues.
Binance emphasized that this was not a simple breach but a multi-stage campaign involving advanced transaction-authorization methods. The $6.34 billion stolen represents the largest sum ever targeted in a cryptocurrency theft, highlighting the growing sophistication of cyber threats in the crypto space.