Binance released a preliminary report on November 3 local time, disclosing details of a cryptocurrency theft involving approximately $6.34 billion in digital assets.
The report stated that current investigations indicate this was a meticulously planned multi-stage attack campaign, not a single isolated intrusion or a simple phishing incident. "The attackers combined multiple techniques, including attacks through fake recruitment interviews, luring downloads of malware, compromising internal AI tools, endpoint intrusions, and the use of advanced transaction authorization methods."
The report mentioned that in June of this year, an engineer from the company's wallet development team had downloaded a tampered software program. Although internal systems detected the issue in time and replaced the engineer's device, the hackers had already obtained information about the engineer's job functions and several colleagues on the team.
In September of this year, an individual impersonating a project director contacted a software engineer at the company through a legitimate job recruitment platform. Subsequently, a person claiming to be the CEO of a certain company conducted an interview with the employee via a social chat application and requested that the employee download an assignment that contained a "malicious code repository."
The report stated that this triggered a series of unauthorized activities. "The malware employed sophisticated obfuscation and evasion techniques, including replacing legitimate development tool components with malicious versions, thereby executing commands and establishing communications with external servers controlled by the attackers."
On October 20 local time, the attackers used the laptop of the engineer who had been tricked into participating in the fake recruitment interview to leverage "internal AI tools" to take control of the computers of two other software engineers responsible for Binance's digital wallets.
On October 29, the day of the incident, the attackers remotely logged into a third engineer's computer and triggered a malicious script to launch the attack.
Binance stated that as of November 3 local time, the company had taken multiple measures, including rebuilding the affected wallet system in a new environment, rebuilding the affected internal AI tools and access control systems, strengthening wallet service risk controls, and enhancing AI-based behavioral anomaly detection. Additionally, the company has engaged third-party cybersecurity experts to conduct a comprehensive review of the incident and will increase investment in AI security and prevention going forward.
Comments