Crypto Exchange Binance Hacked, $40M+ Stolen in Bitcoin

S

sknight

Limp Gawd
Joined
Oct 7, 2009
Messages
131
This is a pretty high-profile heist, as heists come, since Binance is actually the world's biggest crypto exxchange in terms of traded volume. The act was reported by Binance as a well-conducted orchestra, with hackers using seemingly unconnected accounts at the most opportune time to achieve a single, high-value withdrawal of $41M (roughly 7,000 Bitcoin at current pricing) - only 2% of Binance's total value in their so-called "hot wallet".

The hackers also took away with several information on users' accounts: a large number of user API keys, 2FA codes, and "potentially other info" were taken besides the cool $41M in Bitcoin. Binance CEO Changpeng Zhao warned that the hackers could still be controlling enough relevant accounts that could allow them to influence pricing and make even more money.
 
WHAT THE FVCK! Well there goes any defense of crypto I ever had. Do you have a link?
 
330908d1374953128-funny-pic-gif-thread-stupid-comments-grumpy-cat-good-n83ety.jpg
 
motqalden said:
Because an exchange was hacked?
Don't keep your coins on exchange. And and alk sites can be hacked. Doesn't matter if crypto or not
Click to expand...

So if you keep them on your own gear, that can't be hacked?
 
Sycraft said:
So if you keep them on your own gear, that can't be hacked?
Click to expand...

If you keep them on your own gear then that doesn't create a honeypot that every crook on the planet wants to get into. Also the only way the crook would know that the coins are on your box is if you broadcast that to the world or run some really unsecured shit... whereas the crooks know that the exchange has tons of coin.
 
1. If my own shit gets hacked at least i have only myself to blame
2. I'm a much smaller target and why would you even know to look for me
3. good luck hacking a paper wallet or an offline computer. even if you break in and steal it from my house you will need my PW to get the funds
 
pillagenburn said:
If you keep them on your own gear then that doesn't create a honeypot that every crook on the planet wants to get into. Also the only way the crook would know that the coins are on your box is if you broadcast that to the world or run some really unsecured shit... whereas the crooks know that the exchange has tons of coin.
Click to expand...

Ya because nobody writes malware that goes around trying to do things like steal crypto coins... The problem with the "just keep it on your computer" argument is this would be the same argument as "just keep cash in your house." Can you do it safely? Sure, it is possible to do a good job securing your personal devices, just like it is possible to have good physical security for cash. The problem is that you probably don't. Most people are not very good at computer security. It is complex, ever evolving, and can be a pain in the butt. So most people just ignore it and/or lie to themselves that they are doing a good job.

So really it doesn't solve anything, except for allowing crypto evangelists to shift blame and say "Well it was your own fault!" when shit goes down.

Thing is: Banks have solutions to this. Not only do they tend to have WAAAAAY better security than crypto exchanges, but they have contingency plans to deal with it. Transactions are traceable, logged, and can be reversed, they have insurance, etc. While that doesn't mean your money is 100%, can never be stolen EVAR, safe in a bank it is pretty damn safe, particularly compared to trying to keep it yourself.
 
  • Like
Reactions: noko
like this
Alright you have make some good points. So we know that even banks get robbed right? All that this proves is that the exchange was doing the right thing in terms of having a slush fund to cover this . You can't prevent all hacks, but if you have money to cover things like this and take responsibility then really this only speaks to the exchange in a good light.
 
motqalden said:
So we know that even banks get robbed right?
Click to expand...

LOL. Banks are insured. And even if they weren't, the people that rob them (while mostly on the stupid side) have serious balls to risk decades in prison to make some cash. With crypto, any snot nosed anonymous kid from anywhere (ok, 95% China, 5% Russia) can steal your money without getting out of their pajamas. With zero risk of prosecution.
 
Crypto is probably the lowest risk of getting caught when stealing funds
 
Just use a paper wallet that you cut into multiple pieces and store in different safety deposit boxes around the world, simple ;-).
 

“Multi-Billion Binance Hack Hitting Crypto Markets​

BeauHD 13 hours ago		34
Binance is investigating a potential hack after more than $2 billion in crypto was drained from one of its walletsinto a new external account, with Blockaid estimating nearly $3.3 billion was moved.

"Our teams are aware of reports of a potential security issue and are actively investigating," said Binance on X.

"User funds are safe," said Binance founder CZ. "It does look like a hack on Binance. Appreciate the quick freeze from Tether (~$971m) and Circle (~$823m). I don't manage Binance anymore, but as a shareholder, I expect all user funds will be fully covered."”
 
Sycraft said:
Ya because nobody writes malware that goes around trying to do things like steal crypto coins... The problem with the "just keep it on your computer" argument is this would be the same argument as "just keep cash in your house." Can you do it safely? Sure, it is possible to do a good job securing your personal devices, just like it is possible to have good physical security for cash. The problem is that you probably don't. Most people are not very good at computer security. It is complex, ever evolving, and can be a pain in the butt. So most people just ignore it and/or lie to themselves that they are doing a good job.

So really it doesn't solve anything, except for allowing crypto evangelists to shift blame and say "Well it was your own fault!" when shit goes down.

Thing is: Banks have solutions to this. Not only do they tend to have WAAAAAY better security than crypto exchanges, but they have contingency plans to deal with it. Transactions are traceable, logged, and can be reversed, they have insurance, etc. While that doesn't mean your money is 100%, can never be stolen EVAR, safe in a bank it is pretty damn safe, particularly compared to trying to keep it yourself.
Click to expand...
Tell me you don't know how crypto works without telling me you don't know how crypto works. Nice try fearmongering tho

Others saying just anyone could hack it also don't know how crypto works at all.
 
Last edited:
Binance had a fund, but the fund was estimated at a little over $1B.
They say at least $3B is gone. $3B frozen.
Binance is toast.
Have fun getting your money out of there.
After all the lawsuits settled, I think Mt. Gox finally paid off it's users a decade+ later with ~half of what they were owed?

Reminder:
Don't use centralized exchanges.
Don't use centralized crypto (USDC, USDT, Ripple, etc.)
 
IIRC Mt Gox eventually paid its former users what they were legally owed. Unfortunately for them, that was the value in their accounts in Yen at the time of the failure, not the value of the stolen crypto at the time the payout was made. It was only the crypto becoming worth several times what it was at the start of the bankruptcy that allowed the residual left in the exchange to be able to cover its liabilities as specified in bankruptcy law.
 
DanNeely said:
IIRC Mt Gox eventually paid its former users what they were legally owed. Unfortunately for them, that was the value in their accounts in Yen at the time of the failure, not the value of the stolen crypto at the time the payout was made. It was only the crypto becoming worth several times what it was at the start of the bankruptcy that allowed the residual left in the exchange to be able to cover its liabilities as specified in bankruptcy law.
Click to expand...
You're right about the original Yen valuation, but they were sued to force payments in crypto.
You made me curious. Hack was in 2012. Lawsuit settled in 2021. They are currently paying out 142,000 of the 650,000 stolen (<22%). Repayments started in 2024. The deadline for repayments was just extended again to 2027.
 

“Binance Suffers Biggest Crypto Hack In History With $6.3 Billion Affected [UPDATE]​

BeauHD 6 hours ago		73
UPDATE 10/30/26: Binance has temporarily suspended customer withdrawals after suffering what investigators say is the biggest crypto hack in history. According to Binance CEO Yi He, the company estimates roughly $6.3 billion in funds were impacted, with roughly $3 billion in assets frozen on-chain so far. Rest assured, "your money is safe, and we're covering every loss," said co-CEO Richard Teng in a LinkedIn post.

"This was a complex attack," said Teng. "The attacker also used a self-destruct mechanism that destroyed tooling and tracers, making it more difficult for us to trace." From a report: Teng said the incident was not carried out by one person. While the initial investigation indicated the involvement of a compromised laptop, further digging revealed additional points of breach. [...] Blockchain analysis firms TRM Labs and Elliptic have linked the theft to North Korean hackers, with TRM attributing it "with high confidence" to a group known as TraderTraitor, the same group responsible for last year's Bybit hack.

Elliptic estimated Friday that about 44% of the stolen assets have been frozen, with stablecoins accounting for nearly all of those funds. The firm estimated that attackers still controlled over $3 billion in crypto that token issuers cannot directly freeze.

The hackers appear to have compromised Binance's wallet-signing infrastructure, allowing them to authorize transactions that drained billions of dollars in cryptocurrency across multiple blockchains, according to the firms. Binance, in its preliminary stage, has conducted an investigation into the hack, which suggests the incident may have begun with a compromised engineer's laptop. The exchange added that it has found no evidence that wallet passwords were leaked. Below is the original story from yesterday, Oct. 29th.

Binance is investigating a potential hack after more than $2 billion in crypto was drained from one of its walletsinto a new external account, with Blockaid estimating nearly $3.3 billion was moved.

"Our teams are aware of reports of a potential security issue and are actively investigating," said Binance on X.

"User funds are safe," said Binance founder CZ. "It does look like a hack on Binance. Appreciate the quick freeze from Tether (~$971m) and Circle (~$823m). I don't manage Binance anymore, but as a shareholder, I expect all user funds will be fully covered."

At around the same time, crypto-based prediction market Polymarket reported its own security incident that wiped out around $2.7 million in user funds.”
 

"FBI links North Korea to theft of $6 billion from Binance​



WASHINGTON, Oct 31 (Reuters) - The FBI said on Saturday that ‌North Korea was responsible for the theft of more than $6 billion ⁠in virtual assets from cryptocurrency exchange Binance.
Malicious actors from North Korea were observed laundering the stolen assets ‌by ⁠converting them into ethereum, said the FBI, adding that ⁠it expects "further laundering stages" for the stolen ⁠digital assets."

https://www.reuters.com/world/fbi-links-north-korea-theft-6-billion-from-binance-2026-10-31/

1793485656256.png

https://www.bloomberg.com/news/arti...90-of-stolen-crypto-promises-withdrawals-soon
 
erek said:

"FBI links North Korea to theft of $6 billion from Binance​



WASHINGTON, Oct 31 (Reuters) - The FBI said on Saturday that ‌North Korea was responsible for the theft of more than $6 billion ⁠in virtual assets from cryptocurrency exchange Binance.
Malicious actors from North Korea were observed laundering the stolen assets ‌by ⁠converting them into ethereum, said the FBI, adding that ⁠it expects "further laundering stages" for the stolen ⁠digital assets."

https://www.reuters.com/world/fbi-links-north-korea-theft-6-billion-from-binance-2026-10-31/

View attachment 834119
https://www.bloomberg.com/news/arti...90-of-stolen-crypto-promises-withdrawals-soon
Click to expand...

Restore really feels like the wrong word here. They're using cash on hand and insurance payouts to buy replacements for the stolen tokens, not subverting the irrevocability of blockchain transactions by forcing them to be reversed.
 

“Binance Says Hackers Used Fake Job Interviews, AI Tool to Steal $6.3 Billion In Crypto​

BeauHD 5 hours ago		31
Binance says hackers spent months infiltrating its systems through fake job interviews, a tampered developer tool and compromised internal AI tools before stealing $6.34 billion in crypto in the Oct. 29 attack. Co-CEO Richard Teng said Binance has replenished 98% of the affected assets, and that it is still in the process of purchasing outstanding, more illiquid assets. CNBC reports: Preparations for the attack began in June, when a Binance Wallet DevOps engineer downloaded a tampered Homebrew installation "to install a popular AI coding tool after searching for it on a search engine," according to a security reportpublished by Binance Tuesday. It said it detected the suspicious activity, replaced the engineer's device and rotated credentials as a precaution, but that by then the employee's "role and his related colleagues on our wallet infrastructure team was exposed to the hacker."

[...] As of Tuesday Binance has rebuilt the affected wallet system and internal AI tool, replaced compromised devices, decommissioned credentials and tokens associated with the affected engineers and expanded security scans across employee devices, Teng told "Squawk on the Street."

"We're also getting an independent expert to review everything that we have done, and we'll keep strengthening our defenses as the investigation continues," Teng said. "We're working around the clock with law enforcement agencies and with industry partners to trace and freeze the stolen funds for that front."”
 
..a compromised engineer's laptop...
Click to expand...

As is usually the case, like one who thinks they needed all access to everything, wanted to run what ever OS they wanted, no controls, no security, wide open...sounds like most "engineers" assuming development or infra engineer...

Why this still happens is beyond me, bloody ridiculous. Binance with what it has access to should be locked down tigther than Fort Knox when it comes to access for their signing infra...
 
MrGuvernment said:
As is usually the case, like one who thinks they needed all access to everything, wanted to run what ever OS they wanted, no controls, no security, wide open...sounds like most "engineers" assuming development or infra engineer...

Why this still happens is beyond me, bloody ridiculous.
Click to expand...
Because security is hard, inconvenient and boring. Real security, particularly against nation-state type actors, is bureaucracy. You have to pick a security framework, and then develop that in to a set of policies for your organization. Those then have to be developed in to procedures and recommendations. Then you have to implement them consistently, org wide. Then you have to regularly monitor and test to make sure they are implemented consistently and kept up to date. It's a lot of work and a massive pain.

It also interferes with day-to-day activities. You often find that to do things right you can't just copy stuff from your laptop to the server it goes on, there's hoops to jump through and it slows shit down. You can't roll out a patch right away, it has a process, etc, etc. People don't want that as it seems unnecessary, in normal operation it is just an impediment to getting shit done. So they dispense with it and just do things the easy way.

It is going to continue to be an uphill battle. Let me tell you how few people like it when I break out with the stuff from all my GIAC certs.
 
Sycraft said:
Because security is hard, inconvenient and boring. Real security, particularly against nation-state type actors, is bureaucracy. You have to pick a security framework, and then develop that in to a set of policies for your organization. Those then have to be developed in to procedures and recommendations. Then you have to implement them consistently, org wide. Then you have to regularly monitor and test to make sure they are implemented consistently and kept up to date. It's a lot of work and a massive pain.

It also interferes with day-to-day activities. You often find that to do things right you can't just copy stuff from your laptop to the server it goes on, there's hoops to jump through and it slows shit down. You can't roll out a patch right away, it has a process, etc, etc. People don't want that as it seems unnecessary, in normal operation it is just an impediment to getting shit done. So they dispense with it and just do things the easy way.

It is going to continue to be an uphill battle. Let me tell you how few people like it when I break out with the stuff from all my GIAC certs.
Click to expand...
So true. My entire company recent went through a hack. It’s been 3 months and I still don’t have a single non-prod environment. We’re just struggling to get a working production up.

Every server in the company needing to be recreated from on premise to cloud. Extremely strict policies on newly issued laptops. Security is expensive, difficult, and time consuming
 
obs said:
So true. My entire company recent went through a hack. It’s been 3 months and I still don’t have a single non-prod environment. We’re just struggling to get a working production up.

Every server in the company needing to be recreated from on premise to cloud. Extremely strict policies on newly issued laptops. Security is expensive, difficult, and time consuming
Click to expand...
Ya people want magic security where there is no hassle and some magic computer wizard keeps them safe, but that just doesn't work anymore. It used to be like that, in the early days you hired a wizard and hoped your wizard was better than the bad wizards that tried to hack you. Just doesn't work against modern attacks. You can have the smartest security guys on the planet, the best wizards, there's too many paths in, you have to do it the hard, bureaucratic way, same as physical security is done.

I wish there was a way to do it that wasn't a pain to users but there just isn't.
 
Agree, why I love my current job because the owners understand what is at risk and so I have pretty much rule over what needs to be implemented, so long as i can justify the why's clearly.

It is finding that balance, but for a system like the one compromised that managed keys...they should of had some serious processes in place to even connect to that system, let alone pull anything off it!

When our home networks are more secure than most companies, scary thought.
 
MrGuvernment said:
Agree, why I love my current job because the owners understand what is at risk and so I have pretty much rule over what needs to be implemented, so long as i can justify the why's clearly.

It is finding that balance, but for a system like the one compromised that managed keys...they should of had some serious processes in place to even connect to that system, let alone pull anything off it!

When our home networks are more secure than most companies, scary thought.
Click to expand...

Multiple risk levels needing different policies is a very important part. When I worked at a defense contractor our main network laptops had reasonably permissive policies which with one exception* rarely go in the way. The air gapped networks where anything classified lived OTOH were heavily locked down.

In Binances case, anything that could affect their hot wallets should have been airgapped from the main network. Requiring someone on-prem to sneakernet any changes across (or retype from paper if not large) isn't unreasonable when you've got 9+ figures of wealth involved; and would make things a lot harder for anyone trying to hack in.

* The one exception being that Corporate IT refused to get its head around OSS software being downloaded via package managers not browsers. They ran some sort of NTLM based authentication system that blocked almost every piece of software other than browsers from being able to download files from the internet. Unsurprisingly the one exception was Visual Studio and it's NuGet package manager. As a mostly C# dev it wasn't bad for me, but was misery for anyone doing Java or Rails.

The unofficial advice from the IT people in charge of actually getting stuff done was to disconnect from the work network, tether to your phone and run the package manager over that connection. 🤦🤦‍♂️🤦‍♀️

Dev management was pushing a rails stack hard for new projects when I left; I have no idea if corporate IT eventually relaxed network restrictions for package managers to work normally before someone screwed up while tethered to their phone and triggered a minor internal crisis.
 
Updated list of events...
https://lnkd.in/p/gkGc6HRb
https://www.linkedin.com/pulse/29-october-binance-security-incident-initial-findings-response-modgf/

And it was the DevOps person.. someone who likely had more privileges than needed, and this is why Cyber and IT often do not like dealing with developers, they seem to miss the very basics around security..

It's confirmed! Contagious Interview was part of the attack strategy that compromise Binance.

Binance has published its timeline of the attack on its wallet infrastructure. It wasn't one breach. It was a chain of compromises that took about four months to reach wallet signing operations.

Here's the sequence Binance describes.
1️⃣ June 2026: A Wallet DevOps engineer searched for a popular AI coding tool and installed it through a tampered Homebrew installation. Binance caught it, replaced the device, and rotated credentials. But the attacker now knew who worked on the wallet infrastructure team.

2️⃣ September 2026: A second engineer was contacted on a legitimate job platform and went through two interview rounds with a fake company. The first interviewer built trust over live video by sharing a social media account full of personal photos and videos. In the second round, the engineer was told to download a coding "assignment" onto his work computer. Malicious code ran during setup.

3️⃣ 20 October 2026: From that engineer's machine, the attacker used an internal AI tool to gain control over the June engineer's computer and a third engineer's computer. The June engineer's machine held a container deployment token.

4️⃣ 29 October 2026: In under three hours, the attacker logged into the third engineer's computer, used the stolen credentials to deploy a container, and launched a malicious script against wallet signing operations.

Step 2 is the Contagious Interview playbook. A fake recruiter, a believable hiring process, and a coding test from a malicious repo that compromises the machine the moment it's set up.

One detail worth studying is that the malware swapped out pyenv (the Python version manager) for a malicious version:
- Created pyenv_ next to the real executable in /opt/homebrew/Cellar/pyenv/2.8.0/libexec/
- Deleted the legitimate pyenv (3,344 bytes)
- Renamed pyenv_ to pyenv (3,414 bytes)
- Deleted and recreated the /opt/homebrew/bin/pyenv symlink, then spawned a zsh shell

A trojanized pyenv is a quiet place to persist. Most pyenv setups call it every time a terminal opens, so the payload runs without the developer doing anything unusual. Binance says its endpoint protection didn't detect the malware at the time.

OpenSourceMalware has seen this technique before. The most recent version of PolinRider kicks off a killchain that overwrites npm's lib/cli.js was with a malicious version, so every npm or npx command relaunched the malware.
Click to expand...

Binance Report:

29 October Binance Security Incident: Initial Findings and Response Update​



November 3, 2026

On 29 October 2026, Binance experienced a serious and highly sophisticated security incident. This should not have happened, and we apologise for the concern, disruption and uncertainty it caused our users, partners and the wider industry.

Our first responsibility is to protect users. Binance will absorb the financial impact of the stolen funds, not our users. We have already set aside more than 100% of the funds required to cover the loss. As of 31 October 2026, 98% of the impacted token assets have been replenished and are verifiable on our Proof of Reserves page. We are in the process of purchasing the outstanding, more illiquid assets.

Approximately USD 6.34 billion in digital assets were impacted by the incident. As of this update, approximately USD 2.85 billion in digital assets have been frozen or intercepted, subject to reconciliation and market price volatility.

We have taken immediate action to contain the incident and strengthen the systems involved. The entry points identified as having been used in the attack have been closed. Systems touched in the attack path have been rebuilt or replaced. We have also implemented tighter device controls, enhanced wallet-service risk controls and expanded AI-based behavioural anomaly detection.

This is our initial report. It covers what we know today and what we have already improved. The investigation remains ongoing and our findings will be subject to further independent review. Some technical details will remain confidential to prevent malicious actors from using them to plan attacks. We are engaging independent security firms for further review.

The latest information released by the Federal Bureau of Investigation indicates that the Democratic People’s Republic of Korea is responsible for this incident.

We are sharing this initial report because security improves when the industry learns together.

What happened on 29 October​


The attack unfolded quickly across several networks.

The attacker exploited unauthorized access to an internal wallet signing service to initiate transactions outside the normal withdrawal process.

Between 20:05 UTC and 20:09 UTC, five Binance hot wallets sent 233.46 million XRP to an attacker-controlled address.

Binance hot wallets on Solana and Optimism sent approximately 970,500 SOL and 44.2 million OP to attacker-controlled addresses.

Binance then received an internal alert regarding large-volume transfers and immediately began investigating.

Binance hot wallet sent 18,270 BTC to an attacker-controlled address.

The attacker then used the signing service to exploit Ethereum’s EIP-7702 authorization mechanism. EIP-7702 allows an account to delegate certain execution rights to a smart contract without exposing the private key. In this case, the attacker used that mechanism to give an attacker-controlled smart contract partial execution rights over a Binance hot wallet.

Binance immediately initiated multiple containment measures, including suspending withdrawals to restrict further outflows, coordinating with partners to freeze affected tokens, and taking steps to revoke unauthorized permissions. These efforts froze a total of $2.85 billion in assets.

However, suspending withdrawals alone could not stop all unauthorized asset movements. The malicious EIP-7702 authorizations existed on-chain and operated independently of Binance’s normal withdrawal infrastructure.The attackers submitted 50 signing transactions to manipulate the account nonce and establish malicious delegation authorizations. Once established, these authorizations enabled the attackers to continue moving assets independently of Binance's normal withdrawal infrastructure. Binance needed additional transactions to revoke these on-chain authorizations.

The containment process involved additional technical complexities. Because the hot wallet used Multi-Party Computation (MPC), there was no single private key that could be used to immediately revoke the malicious EIP-7702 authorizations. The team therefore developed and executed a specialized procedure to revoke these authorizations, which required additional time. Furthermore, suspending withdrawals and shutting down hot wallet services did not automatically invalidate existing on-chain authorizations.

These challenges extended the time required to fully contain the unauthorized asset movements. We are reviewing the incident response process, signing policy coverage, hot wallet controls and identifying opportunities to further strengthen our ability to respond rapidly to threats in the future.

The final unauthorized transfer of 2,961.9 ETH finalised on-chain at 23:56 UTC. The transaction had previously been broadcast and remained pending before subsequently finalising. No further unauthorised transfers were observed after.

At 00:10 UTC on 30 October 2026, Binance executed a new authorization from the Binance14 hot wallet to the zero address, clearing the EIP-7702 delegation code.

Attack Preparation​


Our current investigation indicates that this was a sophisticated, multi-stage campaign. It was not a single isolated breach or a simple phishing incident. The attackers combined a range of techniques, including social engineering by fake recruitment interviews, malicious software downloads, compromised internal AI tooling, endpoint compromise, and an advanced transaction-authorisation method.


  • June 2026 — Supply chain attack. Engineer A from Wallet DevOps downloaded a tampered Homebrew installation in order to install a popular AI coding tool after searching for it on a search engine. Our security team detected the anomaly, replaced the device, and rotated all related credentials as a proactive security action. However, Engineer A’s role and his related colleagues on our wallet infrastructure team was exposed to the hacker.
  • Throughout 2026, Binance's security team detected and prevented 57 suspected North Korea-linked cyber threat cases. These attempts reflect the persistent threat posed by state-sponsored actors targeting the cryptocurrency industry. The techniques include fraudulent job interviews, malicious software disguised as popular developer tools, compromised software packages and browser extensions, fake video conferencing applications, and social engineering campaigns designed to steal credentials or deploy remote access malware.
  • September — social engineering. Software Engineer B was contacted through a legitimate job-hunting platform by an individual posing as a Project Director. Software Engineer B had a profile on the platform that referenced his experience at Binance. The purported Project Director arranged a first-round interview with a HR representative, followed by a second-round interview with an individual claiming to be the CEO of a fictitious company.
  • In the first round, the purported HR representative conducted a live video interview with Software Engineer B. The interviewer shared a social media account with him, including personal photos and videos posted on the platform, in order to build trust. This was more advanced and deceptive than previously seen social engineering approaches.
  • The second interview was conducted in a popular social chat app, near the end of the interview, Engineer B was instructed to download an “assignment” containing a malicious code repository onto his work computer. The repository contained malicious code that executed during the setup process, initiating a series of unauthorized activities.
  • The malware employed sophisticated obfuscation and evasion techniques, including replacing a legitimate development tool component with a malicious version to execute commands and establish communication with an attacker-controlled external server. The 0-day malware was not detected by the endpoint security protection tools at the time. The attacker also took steps to conceal the malicious activity and remove traces of the compromise, making detection and subsequent investigation more challenging.
  • The script executed the below steps by applying obfuscation techniques to evade security detection.



CREATE /opt/homebrew/Cellar/pyenv/2.8.0/libexec/pyenv_

MODIFY pyenv_ → 3,414 B

DELETE .../libexec/pyenv (3,344 B) ← remove the valid pyenv

RENAME pyenv_ → pyenv (3,414 B) ← replace it with a malicious version

DELETE /opt/homebrew/bin/pyenv (3,414 B)

ln (create a new symlink) + spawn zsh


  • 20 October — use of an internal AI tool as a springboard. The attacker leveraged the compromised computer of engineer B and used an internal AI tool to gain control over the Wallet DevOps Engineer A and another Wallet Software Engineer C. The attacker soon discovered Wallet DevOps Engineer A had a container deployment permission token on his computer.
  • 29 October — reach into wallet signing operations. On 29 October between 17:15 and 19:56, the attacker logged onto Software Engineer C’s computer, used the credentials stolen from Wallet DevOps Engineer A, deployed a container, and triggered a malicious script to launch the attac

What we have done​


As of Nov 3, 2026, we have taken the following actions:

  • Rebuilt the affected wallet system in a new environment.
  • Rebuilt the affected internal AI tool and access controls.
  • Replaced affected devices.
  • Decommissioned credentials and tokens related to affected engineers.
  • Completed enhanced security scans across all employee devices.
  • Enhanced AI-based behavioural anomaly detection.
  • Strengthened wallet-service risk controls.
  • Worked with law enforcement, blockchain intelligence firms and industry partners to trace and freeze affected assets.

We will continue to strengthen our measures as the investigation progresses. There are a number of security measures we have implemented and are implementing that will remain private to prevent malicious actors from compromising our security.

Further actions​


We are taking the following steps immediately.

  1. Independent cybersecurity review. We are engaging independent third-party cybersecurity experts to conduct a comprehensive review of the incident, validate our findings and recommend additional measures. The scope and findings of that review will inform our continuing remediation work.
  2. Expanded investment in AI security and prevention. We are increasing investment in AI-enabled detection, endpoint protection, developer-environment security and behavioural anomaly monitoring.
  3. Security research fund and industry initiatives. We are working on establishing a security research fund and targeted initiatives with leading AI companies, industry participants and security firms focused on AI security in blockchain environments.

We will continue to proactively share information as and when we have it.
Click to expand...
 
  • Like
Reactions: erek
like this
The fact the timeline started in june do show that it was quite sophisticated (and by one of the most advanced hacker group in the world), maybe not to the level of what they did to steal from traditional banks in the past, but still....

It took advantage of basic flaws in some part of the attack, but the part where they acted faster then the protocol were trying to freeze asset/circuit breaker once the attack get detected or how they adapted once they were in system and got detected, there is a list of things they achieved here not everyone can do.
 
Last edited:
LukeTbk said:
The fact the timeline started in june do show that it was quite sophisticated (and by one of the most advanced hacker group in the world), maybe not to the level of what they did to steal from traditional banks in the past, but still....

It took advantage of basic flaws in some part of the attack, but the part where they acted faster then the protocol were trying to freeze asset/circuit breaker once the attack get detected or how they adapted once they were in system and got detectedand, there is a list of things they achieved here not everyone can do.
Click to expand...
Def, the long game these more advance groups are playing vs the quick in and outs, are pretty intriguing for sure. The patience and skill to go on for so long, trying every avenue and not making a mistake to give up your true goal....

They must of done serious recon to find those time limits and when alerts would kick off, I guess with Binance doing so much traffic, they allowed such larger transfers. For me, my first thought would be, very low limits on external wallets period with an approval process...or maybe those numbers for binance, were low, a few billion, meh, what ever!
 
They have lot of experience and extremelly high talent level in NK, that one 10 years ago:

https://www.bbc.com/news/stories-57520169

Was about 13 months long, attacking the federal reserve bank of New-York via the international SWIFT bank system after infiltrating the bangladesh national bank.

They wrote modular malware to actively patch Oracle databases in memory, intercept transaction print routines on physical dot-matrix hardware to hide their tracks, and weaponized a precise window of international holiday time zones to stall banking freezes.

They select the country elite really young to form them in an special tech school and have the ressource to play many very long game all around the world until one work
 
You must log in or register to reply here.
Back
Top