Cryptocurrency exchange Binance has released a detailed account of how hackers stole $6.34bn in digital assets from its platform, revealing that the attackers used fake job interviews, malicious software and compromised developer tools to infiltrate its systems.
The company said on Tuesday that it had replenished 98 per cent of the affected assets using its own funds, while the remaining balance involved less-traded cryptocurrencies that were more difficult to acquire.
The attack, which lasted approximately four hours on October 29, was attributed by the United States Federal Bureau of Investigation (FBI) to hackers linked to North Korea.
However, Pyongyang has denied the allegations, with the powerful sister of North Korean leader Kim Jong Un describing the accusation as “absurd rhetoric”.
Binance disclosed that approximately $2.85bn of the stolen $6.34bn had been frozen, preventing the attackers from spending the funds or converting them into other cryptocurrencies.
The incident, regarded as one of the largest cryptocurrency heists ever recorded, triggered a sharp decline in the prices of several major digital currencies.
According to Binance, the attackers began preparing for the breach as early as June, initially targeting a platform engineer through a compromised version of the widely used programming software, Homebrew.
The hackers allegedly tricked the engineer into downloading a virus-infected version of the software, allowing them to collect information about the employee and his colleagues.
Although Binance’s cybersecurity team detected and removed the malware, the attackers had already gathered information that helped them pursue further access to the company’s systems.
In September, the hackers approached another Binance engineer through a legitimate job-search platform, offering an interview for a position at a fictitious company.
After building trust through the exchange of social media photographs and videos, the attackers asked the engineer to download a technical assessment as part of the recruitment process.
Binance said the exercise contained malware that deployed “sophisticated obfuscation and evasion techniques”, including the replacement of a legitimate component of a development tool with a malicious version.
The compromised software component proved crucial to the operation, enabling the attackers to establish a connection with Binance’s internal systems.
On October 20, the hackers exploited the access they had obtained, alongside an internal artificial intelligence tool, to gain control over software used by two other engineers.
Nine days later, they activated malicious code that triggered the theft, completing the attack within approximately four hours.
