Cryptocurrency exchange Binance has disclosed the mechanics behind a devastating cyber attack that led to the loss of $6.34 billion in digital assets. According to findings corroborated by the FBI, North Korea orchestrated the operation, which relied on months of preparation, social engineering, and compromised internal tools rather than a simple, single-day breach.
The sequence of events began months before the actual theft. In June, a Wallet DevOps engineer inadvertently downloaded a tampered installation for an AI coding tool, which exposed colleague information. By September, attackers targeted a Binance software engineer through legitimate job-hunting platforms. The victim completed two rounds of interviews with a supposed HR representative and a fictitious CEO, ultimately downloading a malicious assignment file disguised as a setup process.
Binance reported that the malware used sophisticated evasion techniques, substituting authentic development components and scrubbing its own traces. By late October, the hackers leveraged the compromised engineer's machine to infiltrate internal AI tools and take control of other employee workstations. On October 29, the attackers executed the final script using stolen credentials. Despite freezing $2.85 billion and rebuilding affected wallet systems, transactions already authorized continued to move.
In the wake of the breach, Binance stated it will fully absorb the financial impact. The exchange has successfully replenished 98 percent of affected tokens, overhauled device security, and deployed enhanced AI-powered anomaly detection capabilities to guard against future vectors of attack.
Comments