About $6.34 billion was transferred out of Binance on October 29. In a preliminary report published last night, @binance said the attackers’ first two points of entry were things crypto professionals do almost every day: searching for an AI coding tool to install, and taking a job interview.
The first entry point was in June. Wallet operations engineer A searched for a popular AI coding tool, but downloaded a tampered Homebrew installer. Binance’s security team detected the anomaly at the time, replaced the computer, and rotated the credentials. Replacing the computer stopped that intrusion, but it couldn’t undo the information that had already leaked: the attackers knew A’s role and the identities of colleagues on his wallet team.
The second entry point was in September. Engineer B was contacted on a legitimate job platform by someone claiming to be a project director. The first interview was a video call with HR, and the person also shared social media accounts featuring personal photos and videos to gain B’s trust. The second interview was with someone claiming to be the CEO, who eventually asked B to download a coding assignment to his work computer. When installed, the repository ran automatically, replaced the computer’s pyenv with a malicious version, and connected to the attackers’ server. The endpoint protection software did not raise an alert.
The subsequent steps all relied on these two computers. On October 20, using B’s computer and an internal AI tool, the attackers took control of the computers of A and another wallet engineer, C, and found a container deployment token on A’s computer. On October 29, they used the token to deploy a container and call the signing service to transfer out the assets.
SlowMist founder Yu Xian @evilcos believes this was an advanced persistent threat that lasted for months. Those who have read the report should check whether they or their colleagues could fall for similar supply-chain attacks. Binance said it has blocked 57 similar suspected North Korea-linked attempts this year, involving tactics such as fake interviews, malware disguised as popular developer tools, and fake video conferencing software. The attempts it failed to stop this time were the installer found through a search in June and the interview assignment in September.
$BNB $BTC
The first entry point was in June. Wallet operations engineer A searched for a popular AI coding tool, but downloaded a tampered Homebrew installer. Binance’s security team detected the anomaly at the time, replaced the computer, and rotated the credentials. Replacing the computer stopped that intrusion, but it couldn’t undo the information that had already leaked: the attackers knew A’s role and the identities of colleagues on his wallet team.
The second entry point was in September. Engineer B was contacted on a legitimate job platform by someone claiming to be a project director. The first interview was a video call with HR, and the person also shared social media accounts featuring personal photos and videos to gain B’s trust. The second interview was with someone claiming to be the CEO, who eventually asked B to download a coding assignment to his work computer. When installed, the repository ran automatically, replaced the computer’s pyenv with a malicious version, and connected to the attackers’ server. The endpoint protection software did not raise an alert.
The subsequent steps all relied on these two computers. On October 20, using B’s computer and an internal AI tool, the attackers took control of the computers of A and another wallet engineer, C, and found a container deployment token on A’s computer. On October 29, they used the token to deploy a container and call the signing service to transfer out the assets.
SlowMist founder Yu Xian @evilcos believes this was an advanced persistent threat that lasted for months. Those who have read the report should check whether they or their colleagues could fall for similar supply-chain attacks. Binance said it has blocked 57 similar suspected North Korea-linked attempts this year, involving tactics such as fake interviews, malware disguised as popular developer tools, and fake video conferencing software. The attempts it failed to stop this time were the installer found through a search in June and the interview assignment in September.
$BNB $BTC
