Threat actors targeted multiple software engineers at Binance with sophisticated social engineering and zero-day malware in a months-long campaign that led to a record-breaking digital heist last week, the crypto exchange has revealed.
Binance revealed the news in a lengthy post on X (formerly Twitter) on November 3.
“It was not a single isolated breach or a simple phishing incident,” it explained.
“The attackers combined a range of techniques, including social engineering by fake recruitment interviews, malicious software downloads, compromised internal AI tooling, endpoint compromise, and an advanced transaction-authorisation method.”
Read more on crypto theft: Hackers Exploit BTCPay Server Flaw to Steal Cryptocurrency.
The main point of intrusion appears to have stemmed from an interview the threat group set up with an unnamed “Software Engineer B” in September.
An individual posing as a project director contacted the engineer via a legitimate job-hunting platform, having spotted from their profile that they worked at Binance.
The first-round interview was held with a fictitious HR representative, during which the interviewer shared a social media account with the engineer, including personal photos and videos posted, in order to build trust, Binance said.
“The second interview was conducted in a popular social chat app, near the end of the interview, Engineer B was instructed to download an ‘assignment’ containing a malicious code repository onto his work computer,” it continued. “The repository contained malicious code that executed during the setup process, initiating a series of unauthorized activities.”
According to Binance, the “zero-day malware” used obfuscation and evasion techniques to ensure it was not detected by the engineer’s endpoint security tools. These included replacing a legitimate development tool component with a malicious version to execute commands and connect with a C2 server.
The Pathway to Wallet-Signing Operations
On October 20, the attacker accessed an internal AI tool via Engineer B’s computer to compromise the machines of two other Binance employees: Wallet DevOps Engineer A and Wallet Software Engineer C.
The former had been scoped out back in June when they unwittingly downloaded a malicious version of Homebrew, a third-party package manager for macOS, after clicking on a malicious search ad.
Although the Binance team “detected the anomaly, replaced the device, and rotated all related credentials” at the time, the engineer’s role and those of his colleagues had already been exposed to the hackers.
After compromising Engineer A’s machine, they found out he had a container deployment permission token on his computer.
“On October 29 between 17:15 and 19:56, the attacker logged onto Software Engineer C’s computer, used the credentials stolen from Wallet DevOps Engineer A, deployed a container, and triggered a malicious script to launch the attack,” the report explained.
Between 20:05 UTC and 20:09 UTC, five Binance hot wallets then sent 233.46 million XRP to an attacker-controlled address, while Binance hot wallets on Solana and Optimism sent around 970,500 SOL and 44.2 million OP to attacker-controlled addresses.
Clean-Up Time
Binance said it has since rebuilt the affected wallet system and internal AI tool along with the latter’s access controls, and that it has replaced affected devices.
It also decommissioned engineer credentials and tokens, enhanced security scans across employee devices, improved AI-based behavioral anomaly detection and strengthened wallet service risk controls.
The firm admitted it had already detected and prevented 57 suspected North Korean attacks this year alone. It is currently conducting a review of the incident, setting up a security research fund with industry partners, and has already increased investment in AI-enabled detection, protection and monitoring tools.
Experts from Fortra questioned the controls that were originally in place to protect employee, and especially developer, machines.
“In a world where quiet quitting exists, it should come as no surprise that employees are interviewing on company time. Organizations need to counter this with adequate controls in place. Particularly, controls around what can be downloaded and executed on a corporate laptop, as well as the permissions granted to the user,” argued Tyler Reguly, associate director, security R&D at Fortra.
“At the end of the day, developer laptops are among the hardest devices in an organization to lock down safely without being detrimental. Organizations need to find the balance point."