13:01Machine-translated from Azerbaijani by AIRead in Azerbaijani
Binance Reveals Details of $6.34 Billion Crypto Theft
In a security report released on November 3, Binance explained how the October 29 cyberattack occurred. During the months-long, multistage operation, approximately $6.34 billion (approximately 10.78 billion manats) in cryptocurrency was stolen. According to the company, this was not caused by a single system vulnerability or a simple phishing technique. On November 1, the U.S. Federal Bureau of Investigation linked the attack to North Korea’s activity known as “TraderTraitor.”
The first known intrusion occurred in June. An engineer on Binance’s cryptocurrency wallet DevOps team downloaded a malicious Homebrew installer while searching online for a popular AI-assisted coding tool. Homebrew is an application developers use to install and manage various tools on macOS. The security team replaced the computer and updated the login credentials. However, by then, the attackers had identified the employee’s role and colleagues. The folder where the malicious files were stored indicates that the attack occurred on an M-series MacBook. In September, another Binance engineer received an offer on a legitimate job-search platform from someone posing as a project director. The fake employer conducted 2 interviews. During one of the meetings, an HR representative joined a live video call and showed a social media account containing personal photos and videos. The other meeting was attended by the supposed CEO of a nonexistent company. Finally, the engineer was asked to download a coding assignment onto a work computer. Malicious code hidden in the assignment replaced a normal component of pvenv, a tool used to manage Python versions. The computer’s security system did not detect it. These intrusions began to produce results on October 20. Using the infected computer and the company’s internal AI tool, the attackers took control of the devices of 2 engineers working on wallets. They also found an access key on the computer targeted in June that authorized software installations. Then, on October 29, they used the stolen information to access another engineer’s computer and run a malicious script. This gave them access to the internal signing service and allowed them to conduct transactions from 5 hot wallets.
After the incident, Binance announced that it had frozen or prevented the transfer of $2.85 billion (approximately 4.85 billion manats) in assets. In total, 98% of the affected funds were recovered. The company will bear the financial burden and compensate users for their losses. North Korea called the U.S. accusation unfounded and said it had no connection to the attack. The methods used in the attack resemble those employed in previous campaigns linked to North Korea. In September, the WaterPlum group infected more than 30,000 devices in 100 countries through fake job postings and coding tests. The group also compromised more than 7,000 cryptocurrency wallets. A similar campaign targeting Python developers in 2024 was linked to the Lazarus group. The group was also implicated in the 2025 attack in which $1.5 billion (approximately 2.55 billion manats) was stolen from the Bybit exchange. Malware hidden in the coding tests in Base64 format gave the attackers remote access to computers.
The first known intrusion occurred in June. An engineer on Binance’s cryptocurrency wallet DevOps team downloaded a malicious Homebrew installer while searching online for a popular AI-assisted coding tool. Homebrew is an application developers use to install and manage various tools on macOS. The security team replaced the computer and updated the login credentials. However, by then, the attackers had identified the employee’s role and colleagues. The folder where the malicious files were stored indicates that the attack occurred on an M-series MacBook. In September, another Binance engineer received an offer on a legitimate job-search platform from someone posing as a project director. The fake employer conducted 2 interviews. During one of the meetings, an HR representative joined a live video call and showed a social media account containing personal photos and videos. The other meeting was attended by the supposed CEO of a nonexistent company. Finally, the engineer was asked to download a coding assignment onto a work computer. Malicious code hidden in the assignment replaced a normal component of pvenv, a tool used to manage Python versions. The computer’s security system did not detect it. These intrusions began to produce results on October 20. Using the infected computer and the company’s internal AI tool, the attackers took control of the devices of 2 engineers working on wallets. They also found an access key on the computer targeted in June that authorized software installations. Then, on October 29, they used the stolen information to access another engineer’s computer and run a malicious script. This gave them access to the internal signing service and allowed them to conduct transactions from 5 hot wallets. After the incident, Binance announced that it had frozen or prevented the transfer of $2.85 billion (approximately 4.85 billion manats) in assets. In total, 98% of the affected funds were recovered. The company will bear the financial burden and compensate users for their losses. North Korea called the U.S. accusation unfounded and said it had no connection to the attack. The methods used in the attack resemble those employed in previous campaigns linked to North Korea. In September, the WaterPlum group infected more than 30,000 devices in 100 countries through fake job postings and coding tests. The group also compromised more than 7,000 cryptocurrency wallets. A similar campaign targeting Python developers in 2024 was linked to the Lazarus group. The group was also implicated in the 2025 attack in which $1.5 billion (approximately 2.55 billion manats) was stolen from the Bybit exchange. Malware hidden in the coding tests in Base64 format gave the attackers remote access to computers.