The perpetrators behind the massive cryptocurrency theft from Binance spent months preparing the operation, employing social engineering tactics alongside novel malware, according to a statement released Tuesday by the company.
Advanced Persistent Threat and Investigation Findings
As reported by Ars Technica, both the FBI and security firm TRM Security attributed the heist to North Korean actors. The attack initially targeted $6.34 billion worth of cryptocurrency held in Binance wallets, though the exchange has successfully frozen or intercepted $2.85 billion of that amount. Binance stated it has designated the necessary funds to cover the remaining losses and directed users to its Proof of Reserves page. This $6.34 billion figure marks the largest sum ever targeted in a crypto-related theft.
Binance reported that the threat actors initiated their efforts no later than June and maintained the operation until the following Thursday, successfully compromising an engineer’s laptop and draining assets from multiple wallets. Characterizing the incident, the company described the attackers as sophisticated and resourceful.
An ongoing investigation report detailed that the operation involved a multi-stage campaign rather than a single breach or basic phishing attack. The methods combined fake recruitment interviews for social engineering, malicious software downloads, compromised internal artificial intelligence tooling, endpoint compromise, and an advanced transaction-authorisation method.
The initial breach activity likely began in June when an engineer downloaded a manipulated version of Homebrew. Although the security team detected the compromised laptop after a related incident report from May, discovery occurred only after the malware operators had already gathered details regarding the engineer and associated colleagues working on the Binance wallet infrastructure team.
