Binance Reveals How Hackers Stole $6 Billion

On October 29, Binance disclosed the methods employed by hackers to orchestrate a $6.34 billion cryptocurrency theft. The exchange attributed the cyber-attack to a series of steps initiated months prior to the actual breach. Binance reported that it had replaced 98% of the affected assets using its own funds. The remaining assets pertain to less commonly traded cryptocurrencies that are more challenging to purchase.

Approximately $2.85 billion of the stolen funds have been frozen, which impedes the attackers from spending or converting those assets. The theft occurred within a span of approximately four hours on October 29. The United States Federal Bureau of Investigation (FBI) implicated hackers with ties to North Korea in the attack. The nation of North Korea, headed by Kim Jong Un, denied the allegation, referring to it as "absurd rhetoric."

Binance is the largest cryptocurrency exchange globally, measured by daily trading volume. The revelation of the breach, which is believed to be the largest crypto heist on record, led to substantial declines across most major cryptocurrencies. According to Binance’s investigation, the hackers commenced their preparations in June.

They managed to persuade an engineer to download a compromised version of Homebrew, a widely utilized software package manager. Binance’s cybersecurity team identified and eradicated the malware. However, the attackers had already amassed information about the employee and their colleagues during this initial intrusion.

A second approach targeting another engineer unfolded in September, when the attackers contacted the engineer through a legitimate recruitment platform. They offered an interview for a position at a non-existent company. To establish credibility, they shared photos and videos from social media. Following the establishment of trust, they requested the engineer to download a technical assignment as part of the interview process.

The assignment contained malware designed to remain undetected and modify a genuine development-tool component with a malicious version. This infection provided the attackers with a critical connection to Binance's internal systems.

On October 20, the attackers utilized their existing access and an internal AI tool to compromise software utilized by two additional engineers. Nine days later, they activated malicious code and executed the theft. The incident unfolded over approximately four hours on October 29.