Key Takeaways
- • Binance said on Tuesday, November 3, that a cyberattack linked to North Korea compromised $6.34 billion in digital assets, which it describes as potentially the largest cryptocurrency theft on record.
- • The exchange said it has frozen or intercepted approximately $2.85 billion of the affected assets and has set aside more than 100% of the funds needed to compensate for losses.
- • As of October 31, Binance had replenished 98% of the affected token assets, with purchases of less liquid cryptocurrencies still underway.
- • The attack began with a months-long social engineering campaign, including fake job interviews and a tampered software package, and culminated in a October 29 breach of the wallet signing infrastructure.
- • Attackers exploited Ethereum's EIP-7702 authorisation mechanism to retain control of a wallet after withdrawals were suspended, and the multi-party computation setup complicated revocation.
Summary
Cryptocurrency exchange Binance said on November 3 that a sophisticated cyberattack linked to North Korea compromised $6.34 billion in digital assets. According to the company, hackers used fake job interviews, malicious software and compromised internal systems to reach its cryptocurrency wallets. The attack occurred on October 29. Binance said it has frozen or intercepted approximately $2.85 billion of the affected assets and will cover the resulting losses. In a detailed statement, the exchange said it had already set aside more than 100% of the funds required for compensation. As of October 31, it had replenished 98% of the affected token assets, with the remaining purchases involving less liquid cryptocurrencies still in progress. Binance apologised, stating, "This should not have happened, and we apologise for the concern, disruption and uncertainty it caused our users, partners and the wider industry."
The breach involved unauthorised access to an internal wallet signing service that allowed hackers to move assets outside the exchange's normal withdrawal process. Per Binance, five hot wallets transferred 233.46 million XRP to an attacker-controlled address within four minutes on October 29. Other wallets on the Solana and Optimism networks transferred approximately 970,500 SOL and 44.2 million OP tokens, and 18,270 Bitcoin was moved from a Binance hot wallet. The attackers later exploited Ethereum's EIP-7702 authorisation mechanism, which lets accounts delegate transaction permissions to smart contracts, to obtain execution rights over a Binance wallet and keep moving assets after withdrawals were suspended. Binance said the attackers submitted 50 transactions to manipulate account permissions. The exchange eventually revoked the permissions, a process complicated by its use of multi-party computation technology, which distributes control of wallet signing. The final unauthorised transfer, involving 2,961.9 Ether, was completed at 23:56 UTC on October 29, and the malicious delegation was cleared shortly after midnight.
Binance's investigation found the attack was prepared over several months. In June, a wallet DevOps engineer downloaded a tampered software installation package while trying to install a popular artificial intelligence coding tool. Binance's security team detected suspicious activity, replaced the device and rotated related credentials, but the incident exposed information about the engineer and colleagues working on wallet infrastructure. In September, the attackers approached another software engineer through a legitimate job-search platform, posing as a project director who arranged interviews with people claiming to be an HR representative and the chief executive of a fictitious company. During the second interview, the engineer was told to download a coding assignment onto a work computer. The assignment contained malware that executed during setup, connected to an external attacker-controlled server, and replaced a legitimate software development component with a malicious version, evading endpoint security. On October 20, the attackers used the compromised computer and an internal AI tool to access two other engineers involved in wallet operations, then found a container deployment token on a DevOps engineer's computer. On October 29, they used the stolen credentials and another engineer's compromised device to deploy a container and run a malicious script against Binance's wallet signing infrastructure.
The breach involved unauthorised access to an internal wallet signing service that allowed hackers to move assets outside the exchange's normal withdrawal process. Per Binance, five hot wallets transferred 233.46 million XRP to an attacker-controlled address within four minutes on October 29. Other wallets on the Solana and Optimism networks transferred approximately 970,500 SOL and 44.2 million OP tokens, and 18,270 Bitcoin was moved from a Binance hot wallet. The attackers later exploited Ethereum's EIP-7702 authorisation mechanism, which lets accounts delegate transaction permissions to smart contracts, to obtain execution rights over a Binance wallet and keep moving assets after withdrawals were suspended. Binance said the attackers submitted 50 transactions to manipulate account permissions. The exchange eventually revoked the permissions, a process complicated by its use of multi-party computation technology, which distributes control of wallet signing. The final unauthorised transfer, involving 2,961.9 Ether, was completed at 23:56 UTC on October 29, and the malicious delegation was cleared shortly after midnight.
Binance's investigation found the attack was prepared over several months. In June, a wallet DevOps engineer downloaded a tampered software installation package while trying to install a popular artificial intelligence coding tool. Binance's security team detected suspicious activity, replaced the device and rotated related credentials, but the incident exposed information about the engineer and colleagues working on wallet infrastructure. In September, the attackers approached another software engineer through a legitimate job-search platform, posing as a project director who arranged interviews with people claiming to be an HR representative and the chief executive of a fictitious company. During the second interview, the engineer was told to download a coding assignment onto a work computer. The assignment contained malware that executed during setup, connected to an external attacker-controlled server, and replaced a legitimate software development component with a malicious version, evading endpoint security. On October 20, the attackers used the compromised computer and an internal AI tool to access two other engineers involved in wallet operations, then found a container deployment token on a DevOps engineer's computer. On October 29, they used the stolen credentials and another engineer's compromised device to deploy a container and run a malicious script against Binance's wallet signing infrastructure.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.