// ARS TECHNICA — FINANZA
Binance says hackers who stole billions in crypto spent months planning heist
Techniques included laptop infections, compromised internal tooling, and fake job interviews.
The hackers who stole billions of dollars in cryptocurrency from the Binance exchange spent months working on the theft and used both social engineering and novel malware in the process, the company said Tuesday.
The heist, which both the FBI and the TRM Security firm attributed to North Korean actors, initially targeted $6.34 billion in cryptocurrency from Binance wallets. The exchange has since frozen or intercepted $2.85 billion of that sum. Binance said it has set aside funds required to cover the loss and provided this link to a Proof of Reserves page. The $6.34 billion represents the biggest sum ever targeted in a cryptocurrency theft.
Binance said the people behind the heist began no later than June and continued until last Thursday, when they successfully compromised an engineer’s laptop and withdrew assets from several wallets. Like just about every organization that suffers a public, high-consequence hack, Binance said the threat actor was sophisticated and resourceful.
“Our current investigation indicates that this was a sophisticated, multi-stage campaign,” a report on the company’s investigation to date said. “It was not a single isolated breach or a simple phishing incident. The attackers combined a range of techniques, including social engineering by fake recruitment interviews, malicious software downloads, compromised internal AI tooling, endpoint compromise, and an advanced transaction-authorisation method.”
Binance said that the first incident related to the compromise likely occurred in June, when an engineer downloaded a tampered version of Homebrew. The company linked to this incident reported in May, and its security team detected the compromised laptop, but only after the malware operators obtained information about the roles of the engineer and his related colleagues on the Binance wallet infrastructure team.
In September, a separate engineer received messages through a legitimate job-hunting platform he was using. The message came from an individual posing as a project director looking to hire new employees. The purported project director arranged a first-round interview with a supposed HR representative and a second-round interview with the purported CEO of the fictitious company.
During the first interview, conducted over a video platform, the purported HR representative shared a social media account that included personal photos and videos. The second interview took place over a social chat app. During it, the engineer was instructed to download an “assignment” that linked to a code repository containing malicious code that eventually executed on the engineer’s device during the setup process.
“The malware employed sophisticated obfuscation and evasion techniques, including replacing a legitimate development tool component with a malicious version to execute commands and establish communication with an attacker-controlled external server,” Binance said. “The 0-day malware was not detected by the endpoint security protection tools at the time. The attacker also took steps to conceal the malicious activity and remove traces of the compromise, making detection and subsequent investigation more challenging.”
On October 20, the attackers used the compromised engineer’s computer and an internal AI tool to take control of two other engineer devices, including the one previously targeted with the trojanized Homebrew installer. That engineer’s wallet contained a token granting access to a container deployment.