Digital Event Horizon
In a sophisticated and complex heist, North Korean hackers stole billions of dollars worth of cryptocurrency from Binance exchange, spending months planning and executing the theft. The attackers used advanced persistent threat tactics, social engineering, and malware to gain access to the exchange's internal systems, highlighting the evolving nature of cyber threats and the need for robust security measures.
The Binance exchange was targeted by hackers who stole an estimated $6.34 billion worth of cryptocurrency. The attack used advanced persistent threat (APT) tactics and sophisticated techniques, including social engineering and malware downloads. The hackers used fake job interviews and a 0-day malware that was not detected by endpoint security tools. The attackers extended their access to an internal wallet signing service, allowing them to complete unauthorized transactions. The stolen assets were laundered through the TRON and Ethereum blockchain networks. The attack is believed to be the largest sum ever targeted in a cryptocurrency theft.
Ars Technica recently reported on a significant cryptocurrency theft that occurred on the Binance exchange, where hackers stole billions of dollars worth of cryptocurrency from users' wallets. According to Binance, the hackers spent months planning and executing the heist, using a range of sophisticated techniques to gain access to the exchange's internal systems.
The attackers, attributed to North Korean actors, initially targeted $6.34 billion in cryptocurrency from Binance wallets. The exchange has since frozen or intercepted $2.85 billion of that sum, and Binance has set aside funds to cover the loss. The heist is believed to be the largest sum ever targeted in a cryptocurrency theft.
Advanced persistent threat (APT) tactics were used by the hackers, who began planning the heist no later than June and continued until last Thursday, when they successfully compromised an engineer's laptop and withdrew assets from several wallets.
The attackers combined a range of techniques, including social engineering, malware downloads, compromised internal AI tooling, endpoint compromise, and advanced transaction authorization methods. They used fake job interviews to gain the trust of the engineers and download malicious software, which eventually executed on the engineer's device during the setup process.
Binance's security team detected the compromised laptop, but only after the malware operators obtained information about the roles of the engineer and his related colleagues on the Binance wallet infrastructure team. The attackers used a 0-day malware that was not detected by endpoint security protection tools at the time.
On October 20, the attackers used the compromised engineer's computer and an internal AI tool to take control of two other engineer devices, including the one previously targeted with the trojanized Homebrew installer. The attackers extended their unauthorized access to an internal wallet signing service to complete transactions outside the normal withdrawal process.
Binance hot wallets on Solana and Optimism sent approximately 970,500 SOL and 44.2 million OP to attacker-controlled addresses. The attacker then used the signing service to exploit Ethereum's EIP-7702 authorization mechanism, which allows an account to delegate certain execution rights to a smart contract without exposing the private key.
The containment process involved additional technical complexities, including revoking malicious EIP-7702 authorizations that existed on-chain and operated independently of Binance's normal withdrawal infrastructure. The attackers successfully laundered the stolen assets through the TRON and Ethereum blockchain networks.
TRM Security, which is tracking the North Korean hacking group under the name TraderTraitor, said that the attackers used various means to launder the stolen assets, including a self-minted token and liquidity pool, a lending receipt token passed between wallets, and cross-chain swaps chained through two bridges.
The sophistication and complexity of the heist highlight the evolving nature of cyber threats and the importance of robust security measures to protect against such attacks.
Related Information:
https://www.digitaleventhorizon.com/articles/The-Sophisticated-Heist-How-North-Korean-Hackers-Stole-Billions-from-Binance-deh.shtml
https://arstechnica.com/information-technology/2026/11/binance-says-hackers-who-stole-billions-in-crypto-spent-months-planning-heist/
Published: Wed Nov 4 11:06:39 2026 by llama3.2 3B Q4_K_M
