Binance says the hackers who stole cryptocurrency from its exchange spent months planning the heist. The company said Tuesday that the attackers used social engineering, malware and a compromised internal AI tool.
The FBI and the security firm TRM Security attributed the theft to North Korean actors, according to the report. The attack initially targeted $6.34 billion in cryptocurrency from Binance wallets. Binance says it has frozen or intercepted $2.85 billion of that amount and has set aside funds to cover the loss.
Binance said the attackers began no later than June. The first known compromise occurred that month, when an engineer downloaded a tampered version of Homebrew. Binance's security team detected the compromised laptop, but only after the malware operators obtained information about the roles of the engineer and his colleagues on the wallet infrastructure team.
In September, a second engineer received messages through a job-hunting platform from someone posing as a project director. The fake recruiter arranged video and chat interviews. During the second interview, the engineer was told to download an "assignment" linked to a code repository. The repository contained malicious code that ran during setup.
Binance said the malware used a 0-day exploit and was not detected by the endpoint security tools at the time. The company said the attacker replaced a legitimate development tool component with a malicious version and then concealed the activity.
On October 20, the attackers used the compromised laptop and an internal AI tool to take control of two more engineer devices. One of those devices held a token that granted access to a container deployment. Nine days later, between 17:15 and 19:56 UTC, the attackers used that token to deploy a container and start a transfer script.
According to the report, the attackers also reached an internal wallet signing service and used it to complete transactions outside the normal withdrawal process. Binance said hot wallets on Solana and Optimism sent about 970,500 SOL and 44.2 million OP to attacker-controlled addresses. A Binance hot wallet also sent 18,270 BTC to an attacker-controlled address.
Binance said the attacker exploited Ethereum's EIP-7702 mechanism to give a malicious smart contract partial execution rights over a hot wallet. Binance said suspending withdrawals did not stop these on-chain authorizations. Because its hot wallet used Multi-Party Computation, no single private key could revoke them, so the team developed a specialized procedure, which took additional time.