Binance Targeted in Multi-Month $6.34 Billion Cryptocurrency Cyber-Heist
As Ars Technica reports, hackers identified by the FBI and TRM Security as North Korean actors successfully targeted $6.34 billion in assets from Binance. The sophisticated campaign utilized social engineering and zero-day malware over several months, resulting in the largest attempted cryptocurrency theft to date despite the exchange successfully intercepting nearly half of the funds.
Context from Industry Pulse
The Binance heist highlights a significant escalation in the tactics used by advanced persistent threat actors against cryptocurrency infrastructure. By blending social engineering through fake recruitment cycles with technical exploits like zero-day malware and EIP-7702 authorization manipulation, the attackers bypassed traditional security perimeters. The $6.34 billion figure marks this as the most ambitious crypto theft attempt in history. While Binance intercepted $2.85 billion, the incident underscores the vulnerability of hot wallets and the complexity of revoking on-chain permissions in multi-party computation environments. The attribution to North Korean actors by federal investigators further situates this breach within a broader pattern of state-sponsored financial cyber-operations aimed at digital asset exchanges.
A report from Ars Technica details a high-consequence breach at Binance that began as early as June. The attackers utilized a multi-stage approach that combined technical exploits with psychological manipulation. The initial entry point involved an engineer downloading a compromised version of the Homebrew development tool, which allowed the threat actors to gather sensitive information regarding the infrastructure of the company wallet team.
By September, the campaign evolved into a targeted social engineering scheme. According to Ars Technica, a separate engineer was contacted through a legitimate job-hunting site by an individual posing as a project director. The hackers staged multiple rounds of fake interviews, including a video call with a supposed human resources representative and a session with a fictitious chief executive. During this process, the engineer was tricked into downloading a malicious code repository disguised as a technical assignment. This malware bypassed existing endpoint security protections and established communication with external servers controlled by the attackers.
In late October, the hackers leveraged the compromised engineer’s workstation and internal AI tools to gain control of additional devices. Ars Technica reports that the attackers eventually accessed a container deployment token and an internal wallet signing service. This access allowed them to move assets outside of the standard withdrawal infrastructure, specifically targeting hot wallets on the Solana, Optimism, and Ethereum networks. The attackers notably exploited Ethereum’s EIP-7702 mechanism to delegate execution rights to their own smart contracts.
Binance responded to the unauthorized transfers by suspending withdrawals and coordinating with industry partners to freeze affected tokens. While the exchange successfully secured $2.85 billion, the recovery process was complicated by the decentralized nature of the on-chain authorizations and the technical requirements of the multi-party computation wallets. The company has stated it will use set-aside funds to cover the remaining losses for its users.
The Industry Pulse Bottom Line
The scale of the Binance breach proves that even major exchanges face existential risks from multi-stage social engineering campaigns, requiring more robust verification for internal tooling and recruitment processes.