Binance Says Hackers Spent Months Preparing for $6.3 Billion Theft
Binance's preliminary report on the attack reveals that hackers began preparations in June, subsequently luring a Binance employee through a fake interview, planting tampered software on their computer, and then using AI tools to infiltrate the wallet system.
TL;DR
- Hackers meticulously planned the $6.3 billion Binance theft over several months, beginning in June.
- A fake job interview was used to lure a Binance employee, leading to the installation of tampered software via a homework assignment.
- The compromised computer and an internal AI tool were then used to gain access to the work computers of two wallet team engineers.
- Exploiting a transaction signing service, hackers began emptying the exchange's hot wallets on October 20th, nine days after gaining initial access.
- The attack utilized a feature that allowed funds to be transferred independently of Binance's systems, making a quick shutdown impossible.
- North Korean hacking group TraderTraitor has been identified by the FBI as responsible for the attack, though North Korea denies the accusation.
- Binance has frozen or intercepted approximately $2.85 billion and will cover customer losses, having already replenished 98% of affected tokens.
- The exchange is rebuilding affected systems, replacing compromised hardware, and collaborating with AI companies for enhanced security.