Binance’s $6.3 Billion Heist Exposes a Months-Long Human and AI Breach
Binance’s $6.3 Billion Heist Exposes a Months-Long Human and AI Breach
The operation, Binance says, began well before the money moved. In June, attackers allegedly started probing the exchange’s wallet team, including by getting an engineer to download a tampered version of a popular software tool. The company described the campaign as more sophisticated and deceptive than anything it had previously encountered.
In September, someone posing as a project director contacted a Binance software engineer on a job platform. Two seemingly credible interviews followed, including a video call with a supposed human-resources representative; the fake recruiter’s social-media profile was reportedly stocked with personal photos and videos. The engineer was ultimately sent an “assignment” file that contained malware undetected by Binance’s security tools.
On Oct. 20, according to Binance’s account, the attackers used the compromised computer and an internal AI tool to seize control of two wallet-team engineers’ machines. One had authority to deploy software. Nine days later, that access was used to reach a transaction-signing service and drain hot wallets—assets held for fast withdrawals—over nearly four hours. “This should not have happened,” Binance said.
The exchange says stopping withdrawals alone could not immediately halt the raid because the attackers had gained partial control of a Binance Ethereum account, where access was recorded on the blockchain rather than solely inside the company’s systems. Binance says it has frozen or intercepted about $2.85 billion, replenished 98% of affected tokens and will cover customer losses.
The FBI on Saturday attributed the attack to TraderTraitor, a North Korean hacking unit; North Korea denied the allegation. Binance says it has also blocked 57 other suspected North Korean hacking attempts this year. The company has rebuilt affected systems, replaced compromised computers and plans an outside security review—a response to a heist that has become crypto’s largest on record.
Write a comment