币安追踪6.3亿美元黑客攻击至虚假招聘面试，AI工具被破坏

A coding assignment from a prospective employer seemed like an ordinary part of a job interview. Instead, it was one step in a months-long cyberattack that ended with $6.3 billion stolen from Binance, raising questions about how exchanges protect themselves against threats that target their employees.

The attack was part of a coordinated campaign that exploited both human vulnerabilities and internal security systems, according to a postmortem released by Binance on Tuesday. The exchange’s findings detailed how hackers gradually gained access to its wallet infrastructure before the Oct. 29 theft.

According to Binance’s security report, the attack campaign began in June, when an engineer downloaded a tampered software package while setting up an AI coding tool. Although Binance detected the malware and replaced the affected device, the attackers had already gathered information about the exchange’s wallet team.

In September, attackers posing as recruiters targeted another software engineer and tricked the employee into downloading a malicious file disguised as a coding assignment. The malware compromised the engineer’s work computer and evaded the exchange’s security protections.

On Oct. 20, the attackers used the compromised computer and an internal AI tool to gain access to two additional engineers’s systems, obtaining deployment credentials that allowed them to install malicious software within Binance’s wallet infrastructure on Oct. 29.

The attackers then gained access to the exchange’s internal wallet-signing service, which authorizes cryptocurrency transactions. This allowed them to move funds outside the normal withdrawal process.

“This wasn’t one mistake or one breach — it was a months-long campaign,” Binance co-CEO Richard Teng said in a Tuesday post on X.

Source: Richard Teng

Binance said the attackers also exploited Ethereum’s EIP-7702 mechanism, which allows wallets to delegate transaction permissions to smart contracts, enabling unauthorized transfers to continue even after the exchange suspended withdrawals. Its multiparty computation (MPC) wallet system, which distributes control over transaction signing, complicated efforts to revoke those permissions.

The breach affected approximately $6.3 billion in digital assets, with Binance reporting that $2.85 billion had been frozen or intercepted, according to its latest accounting. The exchange said it would absorb the losses rather than pass them on to customers and had replenished 98% of the affected token assets as of Oct. 31.

The attack, the largest cryptocurrency hack in history, has been attributed to North Korean hackers by the Federal Bureau of Investigation (FBI). On Tuesday, Kim Yo Jong, the sister of North Korean leader Kim Jong Un, denied the country’s involvement, saying the FBI’s attribution was politically motivated and intended to damage North Korea’s international standing.

Magazine: Binance hackers raced to move billions before it could be frozen