Binance suffered the largest security breach in the history of cryptocurrency, estimated at around $6.3 billion. This historic attack sent shockwaves through digital asset markets, causing major cryptocurrencies to decline.

Binance acted swiftly in cooperation with its partners in the blockchain sector and managed to freeze nearly $3 billion in affected assets to prevent them from being liquidated. This included Tether freezing around $1.57 billion in USDT and Circle freezing more than $800 million in USDC.

Ongoing investigations into the historic Binance breach have revealed complex technical details that point to an advanced, targeted cyberattack known as an “internal supply chain attack.”

The attackers successfully compromised and remotely accessed the personal and work mobile device of a Binance DevOps engineer. The hackers used this device as a conduit to access an internal service container within the platform’s cloud computing environment.

The major technical shock was how funds of this scale were withdrawn despite the multi-signature (Multi-Sig) security systems in place:

• The private keys were not stolen: Investigators confirmed that the attackers did not steal the private keys to the hot or cold wallets, which would have made recovering the funds impossible.

• Spoofing the work environment and authorization: Instead of stealing the keys, the hackers exploited their access to the internal Identity and Access Management (IAM) system. They created malware inside the compromised container that allowed them to simulate legitimate withdrawal requests and route them to the “Automated Signing Service.”

• Bypassing security barriers: This malware successfully forged the criteria and requirements needed to process the transactions, causing the automated system to sign massive withdrawals, believing they were approved and up-to-date internal code instructions from the development team.

Once the funds left Binance’s wallets, the attackers used sophisticated tactics to distribute and try to hide them:

• Malicious smart contracts: The attackers had pre-deployed custom smart contracts on the Ethereum, BNB Chain, and Solana networks, using them as “temporary collection depots” to distribute the stolen funds at lightning speed (flash trading).

• Cross-chain bridges: Assets were immediately transferred through anonymous decentralized bridges to scatter the investigation trail across several different blockchain networks within the same few seconds.

• Crypto mixers: Hundreds of millions were routed through crypto-mixing tools to make the addresses untraceable (although freezing efforts succeeded in trapping around $3 billion of the funds before they were fully mixed).

To contain the attack and stop the bleeding, Binance’s technical team immediately isolated and revoked all access privileges and digital certificates belonging to the affected engineer and the surrounding cloud environment, rebuilt the strategic containers, and updated the multi-signature system.

Here are some of the most notable information and stories surrounding the Binance breach:

🐋 The mysterious “whale” movement that saved the day

• Before Binance officially announced the breach, blockchain tracking accounts (such as Whale Alert) spotted a very unusual movement of stablecoins (USDT and USDC), with billions being transferred from Binance wallets to unknown addresses.

• This community monitoring prompted blockchain security firms to issue the first alert, forcing stablecoin protocols to act and freeze half the amount before the hackers could withdraw or fully launder it.

🎮 The DevOps engineer… victim of a “fake job interview”?

• Technical leaks (not yet officially confirmed by Binance, but consistent with the methods of the Lazarus Group and North Korea) suggest that the development engineer was compromised through a social engineering tactic.

• The engineer received an extremely attractive fake job offer via LinkedIn from a major tech company and was asked to download a “technical test” file. As soon as he ran the file on his device, malware was installed, allowing the hackers to take control of his administrative privileges at Binance.

💸 The incredible “gas fees” paradox

• To speed up the movement of the funds and ensure the system would not stop the transactions, the hackers paid record-breaking network fees (gas fees), reportedly the highest in the history of the Ethereum and BNB networks, to push the transactions through in mere seconds before Binance security engineers could intervene.

📉 Decentralized exchanges (DEXs) rebound

• On the financial front, users’ concerns about centralized platforms following the breach led to a temporary mass migration of funds to decentralized exchanges (such as Uniswap and PancakeSwap). These platforms recorded a surge of more than 40% in daily trading volume within hours of the incident, as users sought to retain control of their ownprivate keys.

#HackerNews #Binance