Binance hack: fake job interviews, a poisoned installer and $6.3 billion

Binance has published a postmortem describing how the largest crypto theft to date unfolded over several months. According to the company, the first step came in June, when a developer downloaded a tampered installer that appears to have been spread through a malicious Google ad. That download exposed details about the engineers and how they work.

Binance says its security teams did detect that first malware installation in June and replaced the worker's device. The company's account is reported by The Verge · Tech (US).

In September, a second engineer was targeted by someone posing as a recruiter interested in hiring them. The person arranged a series of calls and several rounds of interviews, shared social media pages to build trust, and eventually asked the engineer to download a fake interview assignment that was actually malware.

Binance says its security tools did not catch this second attack. The malware deleted the pyenv executable and replaced it with a malicious version, giving the attackers backdoor access.

Binance describes the malware as using sophisticated obfuscation and evasion. It replaced a legitimate development tool component with a malicious version, which let it run commands and communicate with an external server controlled by the attacker.

The company says the 0-day malware was not detected by endpoint security protection tools at the time. The attacker also took steps to hide the activity and remove traces of the compromise, which Binance says made detection and later investigation harder.

By October 20, according to Binance, the attackers used the company's own internal AI tool to take control of wallets belonging to the first engineer compromised in June and to a third employee. They then logged into the third employee's computer on October 29 and launched the attack.

The FBI has identified the group behind it as a North Korean unit dubbed "TraderTraitor." Binance's postmortem does not explain in detail how the internal AI tool helped the attackers.

Binance says the first unauthorized transfers were followed by transactions nearly two hours later that it could not stop. Its explanation: the hot wallet used Multi-Party Computation, so there was no single private key that could immediately revoke the malicious EIP-7702 authorizations.

CEO Richard Teng writes that no user is bearing the loss. About $2.85 billion in stolen assets were frozen or intercepted, and 98% of impacted tokens had been replenished at the time of the post, with withdrawals broadly resumed. Binance says it has prevented 57 suspected North Korea-linked cyber threat cases.