Ing. Calogero Bono
Binance has published its reconstruction of the October 29 attack, which cost assets worth about $6.34 billion. According to the exchange, it was not a sudden blow but a multi-stage campaign that began in June. At the center is a fake job interview that delivered malware to an engineer's computer. The case matters to anyone who has employees, developers or internal tools with sensitive access.
A few terms before we get into the facts. Homebrew is the program many developers use to install software on a Mac. Social engineering means deceiving a person instead of forcing a system. A zero-day malware is never-before-seen code that antivirus tools do not recognize. A hot wallet is a crypto wallet connected to the network, used for everyday movements. MPC is the technology that splits the private key among several parties, so there is no single key.
How did the attack on Binance begin?
According to the reconstruction by DDay, in June an engineer on the Wallet DevOps team searched a search engine for an AI-assisted programming tool. He downloaded a tampered version of Homebrew. The Verge reports that the installer was reportedly distributed through a malicious Google ad.
Binance's security team detected the anomaly, replaced the computer and rotated the credentials. But the attackers had already figured out who worked on the wallet infrastructure.
How did the fake job interview work?
In September another developer was contacted on a genuine job search platform by someone calling himself a "Project Director". The first interview was a video call with a fake HR manager, who shared a social media profile with personal photos and videos to build trust.
The second took place on a chat app, with a fake CEO. Finally came the test project to download. In developer interviews it is a routine request, which is why it worked. Inside was the malware, which activated during installation.
As The Register explains, the code replaced a development component with a malicious version and opened a channel to an external server. Security tools did not detect it right away.
What role did the internal AI tool play?
On October 20 the attackers used the compromised computer to exploit an internal Binance AI tool. In this way they took control of the workstations of two other engineers, including the one involved in June.
On the computer of the latter they found a token with permission to deploy containers in the infrastructure. On October 29, from the computer of the third engineer, they used those credentials, deployed a container and launched the script that started the transfers.
On what the AI tool actually did, The Verge notes that the details are scarce.
How much was blocked and who is behind it?
According to Binance, about $2.85 billion was frozen or intercepted. The loss is borne by the exchange, and as of October 31, 98% of the stolen tokens had already been restored. Operations continued after withdrawals were suspended because they had already been authorized. For the FBI the culprit is North Korea through the TraderTraitor activity, an accusation Pyongyang has rejected.
We also covered this in this article on the FBI attribution and in the first chronicle of the attack.
Limits to know
The reconstruction comes from Binance itself and has not been independently verified. The figures are still subject to verification and price swings. It is not clear why this attack worked, nor why the internal AI tool could help the attackers. The review by independent experts announced by Binance could change the picture.
What changes for those who work digitally
The fake-interview trap works against any company, not just an exchange. If your developers use work computers to test code from strangers, you have an open door. Clear rules, separate devices and minimal permissions are needed, because a single token with too many powers was enough here. Internal artificial intelligence tools must also be treated as attack surfaces. Anyone running servers can rely on a hosting service with managed security updates, but staff training remains decisive.
Our take
Binance did well to publish a detailed account, which is not a given. But the picture leaves us puzzled. It had claimed to have blocked 57 attempts linked to North Korea and, despite that, the same pattern worked. An exchange of that size should separate the devices of people working on wallets from any external activity. The real lesson is organizational, not technological.
Frequently asked questions
How did they deceive the Binance engineer?
With a multi-stage fake job interview. The attackers used a fake HR manager and a fake CEO. In the end they had the engineer download a test project that contained the malware.
How much was stolen from Binance?
The affected assets are worth about $6.34 billion. According to Binance, around $2.85 billion was frozen or intercepted. The loss is borne by the exchange.
Who is responsible according to the FBI?
North Korea, through the activity called TraderTraitor. Pyongyang has rejected the accusation. It is the same activity linked to the Bybit theft.
Did Binance users lose money?
No, according to Binance. The exchange says it is absorbing the loss and has restored 98% of the affected tokens. Withdrawals have largely resumed.
Why could the transfers not be stopped immediately?
Because the delegation was recorded on the blockchain and the wallet used MPC technology. There was no single key to revoke it immediately. A dedicated procedure was needed.
What to watch after the independent review of Binance
Binance has commissioned outside experts to review the incident and propose new measures. The findings will show how avoidable the attack was.
- Read the independent review, if it is published, and look for details on the internal AI tool.
- Follow FBI updates on the laundering of funds and on the addresses linked to the theft.
- Check whether Binance and other exchanges announce common security standards for AI in the blockchain sector.
Sources
- hdblog.it, Un falso colloquio di lavoro per il maxi furto a Binance – la strategia degli hacker
- engadget.com, Binance attackers used fake job interviews to pull off $6.3 billion crypto heist
- dday.it, Un falso colloquio di lavoro e un download avvelenato, così è cominciato il furto da 6,3 miliardi a Binance
- theregister.com, North Korean fake job interview led to $6.3B Binance heist
- theverge.com, Binance says hackers used fake job interviews and an internal AI tool to pull off the $6.3 billion heist
