Breach Details
Binance revealed details of a major security breach that occurred on October 29, resulting in the theft of digital assets estimated at approximately $6.34 billion. According to the incident report, the attackers, whom the FBI attributed to the North Korean-linked Lazarus Group, used sophisticated social engineering techniques to penetrate the company's internal systems.
Attack Chain: From Job Interview to Wallet Breach
The attack began last September when attackers posing as a project manager contacted a Binance software engineer via a recruitment platform. To add credibility, the attackers conducted live video interviews and used fake social media accounts. During the second interview, the engineer was asked to download a "coding assignment" from a code repository, which contained undetected zero-day malware.
The malware managed to bypass security defense tools by replacing a legitimate development tool (pyenv) with a malicious version on macOS, giving the attackers full control over the engineer's device. By October 20, the attackers exploited their access to the engineer's device and an internal artificial intelligence tool to compromise other employees, obtaining credentials and container deployment tokens.
Why This News Matters
This breach highlights the risks of targeted "social engineering" against developers in sensitive tech companies. The attackers' use of custom malware capable of evading traditional antivirus software represents an escalation in advanced persistent threat (APT) methods. The attackers also exploited the EIP-7702 mechanism on the Ethereum network to continue withdrawals even after the platform's attempts to stop them, indicating a precise exploitation of vulnerabilities in blockchain protocols.
Actions Taken
Binance confirmed that it has rebuilt the affected systems, replaced compromised devices, and revoked stolen credentials. By November 3, approximately $2.85 billion of the stolen assets had been frozen or recovered, with 98% of the affected tokens compensated by the end of October. The platform continues its investigations in cooperation with independent security firms to assess the extent of the damage and ensure such breaches are not repeated.