Binance Breach: Months of Planning, Social Engineering Led to $6.34 Billion Cryptocurrency Heist

The cryptocurrency exchange Binance revealed this week that the attackers behind a massive theft of digital assets had invested considerable effort in planning and executing the operation, deploying both social engineering tactics and previously unknown malware. The incident, which investigators from the FBI and the security firm TRM Security have linked to North Korean threat actors, initially targeted $6.34 billion held in Binance cryptocurrency wallets. The exchange has managed to freeze or intercept $2.85 billion of the stolen amount. Binance indicated it has reserved capital to address the shortfall and directed users to its Proof of Reserves documentation. This $6.34 billion figure marks the largest amount ever targeted in a cryptocurrency theft.

Advanced persistent threat

According to Binance's account, the perpetrators initiated their campaign no later than June and maintained their assault through the following Thursday, when they successfully gained access to an engineer's computer and extracted funds from multiple wallets. The company characterized the attackers as displaying the hallmarks of a well-resourced and capable adversary.

Our current investigation indicates that this was a sophisticated, multi-stage campaign. It was not a single isolated breach or a simple phishing incident. The attackers combined a range of techniques, including social engineering by fake recruitment interviews, malicious software downloads, compromised internal AI tooling, endpoint compromise, and an advanced transaction-authorisation method.

Binance investigation report

Binance traced the initial compromise to June, when an engineer obtained a modified copy of Homebrew, a widely-used software package manager. The company referenced a security incident disclosed in May related to this tool, and its own security team eventually identified the affected machine—but only after the malware had already furnished the attackers with details about the engineer's position and those of colleagues working on Binance's wallet infrastructure systems.

During September, a different engineer received contact through a job-search website he was actively using. The message originated from someone claiming to represent a project director seeking to fill positions. The supposed director arranged two interview rounds: one with an alleged human resources specialist and another with the purported chief executive of the nonexistent organization.

The first interview, conducted via video conference, featured the fake HR contact sharing a social media profile containing personal images and recordings. The subsequent interview took place through a messaging application. During this second conversation, the engineer was asked to retrieve an "assignment" that pointed to a code repository harboring malicious software, which activated on his device during the installation phase.

The malware employed sophisticated obfuscation and evasion techniques, including replacing a legitimate development tool component with a malicious version to execute commands and establish communication with an attacker-controlled external server. The 0-day malware was not detected by the endpoint security protection tools at the time. The attacker also took steps to conceal the malicious activity and remove traces of the compromise, making detection and subsequent investigation more challenging.

Binance

On October 20, the threat actors leveraged the compromised engineer's device and an internal artificial intelligence platform to seize control of two additional engineer workstations, including the machine that had been targeted with the trojanized Homebrew package. One of these engineers' systems held a credential granting entry to a container deployment system.

Nine days after that, between 17:15 and 19:56 UTC, the attackers accessed the third engineer's workstation, used the pilfered credential, deployed a container, and ran a script to commence asset transfers. The attackers also expanded their control to encompass an internal wallet signing mechanism, enabling them to move funds outside the standard withdrawal pathway.

The attackers transferred approximately 970,500 SOL from Binance hot wallets on the Solana network and 44.2 million OP from Optimism-based wallets to addresses under their control. Binance's monitoring systems detected the large-scale transfers and the company initiated an immediate investigation. Additionally, the attackers moved 18,270 BTC from a Binance hot wallet to an attacker-controlled address.

The perpetrators then exploited Ethereum's EIP-7702 authorization standard, a mechanism that permits an account to grant specific execution capabilities to a smart contract without revealing its private key. In this instance, the attackers leveraged this feature to assign partial execution authority over a Binance hot wallet to a smart contract they controlled.

Binance swiftly enacted containment procedures, including halting withdrawals to prevent additional outflows, coordinating with external partners to immobilize affected tokens, and working to eliminate unauthorized access permissions. These actions succeeded in locking up $2.85 billion in assets.

Halting withdrawals alone proved insufficient to prevent all unauthorized asset movements, however. The malicious EIP-7702 authorizations existed on the blockchain itself and functioned independently of Binance's standard withdrawal mechanisms.

The attackers submitted 50 signing transactions to alter the account nonce and establish malicious delegation permissions. Once in place, these authorizations permitted the attackers to continue transferring assets without relying on Binance's normal withdrawal infrastructure. Binance required additional transactions to eliminate these on-chain authorizations.

The containment effort encountered further technical obstacles. Since the hot wallet employed Multi-Party Computation (MPC) architecture, no single private key existed that could immediately revoke the malicious EIP-7702 authorizations. Binance's team therefore designed and implemented a specialized procedure to remove these authorizations, a process that demanded additional time. Moreover, merely suspending withdrawals and deactivating hot wallet operations did not automatically nullify the existing on-chain authorizations.

TRM Security separately documented that the attackers employed multiple techniques to obscure successfully transferred assets across the TRON and Ethereum blockchain networks. These techniques encompassed "a self-minted token and liquidity pool, a lending receipt token passed between wallets, and cross-chain swaps chained through two bridges."

TRM monitors the North Korean hacking collective under the designation TraderTraitor.