The largest crypto theft to date was pulled off by combining some well-known hacking techniques over the course of a few months, according to Binance. A postmortem from the company says the process that started with one developer downloading a tampered installer in June apparently spread by a malicious Google ad, exposing details about the engineers and how they work. Then, in September, another engineer was targeted by someone pretending to be interested in hiring them, who set up a series of calls and multiple rounds of interviews, sharing social media pages to build trust, and eventually prompting them to download a fake interview assignment that was actually malware.
Binance claims that its security teams did detect the first installation of malware in June, and replaced the worker’s device, but that its security tools didn’t detect the second attack that deleted the pyenv executable and replaced it with a malicious version that gave them backdoor access:
The malware employed sophisticated obfuscation and evasion techniques, including replacing a legitimate development tool component with a malicious version to execute commands and establish communication with an attacker-controlled external server. The 0-day malware was not detected by the endpoint security protection tools at the time. The attacker also took steps to conceal the malicious activity and remove traces of the compromise, making detection and subsequent investigation more challenging.
By October 20th, the story goes, the attackers, who the FBI has identified as a North Korean unit dubbed “TraderTraitor,” used Binance’s own internal AI tool to gain control over wallets for the first engineer compromised in June, as well as another third employee, before logging into the third employee’s computer on October 29th and launching their attack.
The post-mortem also goes into why Binance wasn’t able to stop the transactions that occurred nearly two hours after the first unauthorized transfers, saying that “Because the hot wallet used Multi-Party Computation (MPC), there was no single private key that could be used to immediately revoke the malicious EIP-7702 authorizations.” Binance says that it’s prevented 57 suspected North Korea-linked cyber threat cases, and CEO Richard Teng writes that no user is bearing the loss, with about $2.85 billion in stolen assets frozen or intercepted: “At this moment, 98% of impacted tokens had been replenished; we’re completing the remaining 2%. Withdrawals have broadly resumed.”
What’s less clear is why this particular attack worked — the danger of job interviews that ask people to download and execute code on machines with access to employer material has been warned about for years, and there’s little detail on the “internal AI tool” that was used by the attackers and why it was able to help them in the first place.