Binance said Tuesday that the people who stole cryptocurrency from its wallets spent months combining social engineering and malware before last week's transfers, Ars Technica reported¹.

Ars said the FBI and TRM Labs attributed the heist to North Korean actors and that about $6.34 billion was initially targeted, with Binance later freezing or intercepting $2.85 billion¹. The $6.34 billion figure is the largest sum ever targeted in a cryptocurrency theft, Ars said, citing TRM¹. Binance said it had set aside funds to cover the loss and pointed to a proof-of-reserves page¹.

Binance said the campaign began no later than June and continued until last Thursday, when attackers compromised an engineer's laptop and withdrew assets from several wallets¹. In an investigation report quoted by Ars, the company said the campaign was "not a single isolated breach or a simple phishing incident"¹.

The first related incident likely occurred in June, Binance said, when an engineer downloaded a tampered version of Homebrew¹. Ars said the company linked that to a May SANS Internet Storm Center report; Binance's security team later detected the laptop, but after operators had learned about the engineer and colleagues on the wallet infrastructure team¹.

In September, a separate engineer received messages on a legitimate job-hunting platform from someone posing as a project director, Binance said¹. After video and chat interviews, the engineer was told to download an assignment from a code repository that contained malware executed during setup¹. Binance said the malware used obfuscation, replaced a legitimate development-tool component, was not caught by endpoint tools at the time, and that operators tried to erase traces¹.

On Oct. 20, attackers used the compromised engineer's computer and an internal AI tool to take control of two other engineer devices, including the Homebrew-targeted machine, Binance said¹. That engineer's wallet held a token for a container deployment¹. Nine days later, between 17:15 and 19:56 UTC, the actor logged into the third engineer's device, deployed a container and started transfers, extending access to an internal wallet signing service, according to the company¹.

Binance said hot wallets on Solana and Optimism sent about 970,500 SOL and 44.2 million OP to attacker-controlled addresses, then a hot wallet sent 18,270 BTC after an internal large-transfer alert¹. Attackers then used the signing service and Ethereum's EIP-7702 mechanism to give an attacker-controlled contract partial execution rights over a hot wallet, the company said¹.

Binance said it suspended withdrawals, coordinated freezes totaling $2.85 billion and later had to revoke on-chain EIP-7702 authorizations that kept moving assets outside normal withdrawal infrastructure¹. Because the hot wallet used multi-party computation, there was no single private key to revoke those authorizations immediately, and the team built a specialized procedure, Binance said¹.

Separately, TRM said successfully transferred assets were laundered on TRON and Ethereum, including a self-minted token and liquidity pool, a lending receipt token and cross-chain swaps through two bridges, Ars reported¹. TRM tracks the group as TraderTraitor¹. Independent confirmation of the attribution, remaining unrecovered amounts and whether other exchanges were hit was not in the Ars account¹.

Sources

1. Ars TechnicaBinance says hackers who stole billions in crypto spent months planning the heist11:07 AM

Read the original at Ars Technica ↗