Binance’s $6.3 Billion Heist Exposes a Security Failure Months in the Making
Binance’s $6.3 Billion Heist Exposes a Security Failure Months in the Making
The attack, Binance says, did not begin with a dramatic breach. It began in June, when hackers allegedly started probing the exchange’s wallet team and persuaded an engineer to download a tampered version of a popular software tool. The company says the operation was more elaborate than anything it had previously faced.
In September, a person posing as a project director contacted another Binance software engineer through a job platform. After two interviews — including a video call with someone claiming to be in human resources — the engineer was sent an “assignment” to download onto a work computer. The file contained malware that Binance’s security tools failed to detect.
On October 20, a week before the theft, the attackers allegedly used that machine and an internal AI tool to take control of two wallet-team engineers’ computers. One had software-deployment privileges. Nine days later, that access opened a transaction-signing service, allowing the attackers to begin draining Binance hot wallets over nearly four hours.
“This should not have happened,” Binance said in its preliminary account of what it calls the largest theft in crypto’s history. The exchange argues that halting withdrawals alone could not stop the raid: the attackers had gained partial control of an Ethereum account, where access was recorded on the blockchain rather than solely within Binance’s own systems.
The alleged attackers then moved the stolen cryptocurrency through roughly 12,000 wallets, an effort to obscure its path and frustrate freezes. U.S. authorities have attributed the operation to TraderTraitor, a North Korean hacking group — an allegation Pyongyang denies. Binance says it has intercepted 57 other suspected North Korean attacks this year.
Binance says about $2.85 billion has been frozen or intercepted and that it has replenished 98% of affected tokens. It has rebuilt the targeted systems, replaced compromised computers and plans an outside security review — a recovery effort shadowed by a stark admission: its defenses failed before the money moved.
Write a comment