Ethical Hacking News
North Korean hackers have stolen billions of dollars in cryptocurrency from Binance, using a combination of social engineering and novel malware to execute the heist. The theft has been attributed to North Korean actors, who spent months planning and executing the attack. Binance has set aside funds to cover the loss and provided a link to a Proof of Reserves page, demonstrating the company's commitment to transparency and accountability.
Binance suffered a devastating attack resulting in the theft of billions of dollars in cryptocurrency. The attack was attributed to North Korean actors who spent months planning and executing the heist. The hackers used a combination of social engineering, malware, and compromised internal tooling to execute their plan. The attack began in June and continued until October, with the attackers using sophisticated obfuscation and evasion techniques. The attackers successfully withdrew assets from several wallets and laundered them through the TRON and Ethereum blockchain networks. Binance has set aside funds to cover the loss and provided a link to a Proof of Reserves page to demonstrate its commitment to transparency and accountability.
Binance, one of the world's largest cryptocurrency exchanges, has suffered a devastating attack that saw hackers steal billions of dollars in cryptocurrency. The theft, which was initially targeted at $6.34 billion in cryptocurrency from Binance wallets, has been attributed to North Korean actors, who spent months planning and executing the heist.
According to Binance, the hackers began their campaign as early as June and continued until last Thursday, when they successfully compromised an engineer's laptop and withdrew assets from several wallets. The attackers combined a range of techniques, including social engineering, malware, and compromised internal tooling, to execute their plan.
The first incident related to the compromise occurred in June, when an engineer downloaded a tampered version of Homebrew, a development tool. The malware operators then obtained information about the roles of the engineer and his colleagues on the Binance wallet infrastructure team, allowing them to gain access to the system.
In September, a separate engineer received messages through a legitimate job-hunting platform, posing as a project director looking to hire new employees. The purported project director arranged a first-round interview with a supposed HR representative and a second-round interview with the purported CEO of a fictitious company. During the interviews, the engineer was instructed to download an "assignment" that linked to a code repository containing malicious code.
The malware employed sophisticated obfuscation and evasion techniques, including replacing a legitimate development tool component with a malicious version to execute commands and establish communication with an attacker-controlled external server. The attackers also took steps to conceal the malicious activity and remove traces of the compromise, making detection and subsequent investigation more challenging.
On October 20, the attackers used the compromised engineer's computer and an internal AI tool to take control of two other engineer devices, including the one previously targeted with the trojanized Homebrew installer. The attackers extended their unauthorized access to an internal wallet signing service to complete transactions outside the normal withdrawal process.
Binance hot wallets on Solana and Optimism sent approximately 970,500 SOL and 44.2 million OP to attacker-controlled addresses. The attackers then used the signing service to exploit Ethereum's EIP-7702 authorization mechanism, giving an attacker-controlled smart contract partial execution rights over a Binance hot wallet.
The containment process involved additional technical complexities, including the use of Multi-Party Computation (MPC) to revoke the malicious EIP-7702 authorizations. The team developed and executed a specialized procedure to revoke these authorizations, which required additional time.
Separately, TRM Security said the attackers used various means to launder successfully transferred assets through the TRON and Ethereum blockchain networks, including "a self-minted token and liquidity pool, a lending receipt token passed between wallets, and cross-chain swaps chained through two bridges."
In a statement, Binance said that the threat actor was sophisticated and resourceful, and that the company had set aside funds required to cover the loss. The company has provided a link to a Proof of Reserves page, which demonstrates the company's commitment to transparency and accountability.
The theft has been attributed to North Korean actors, who have been linked to several previous hacking incidents. The attackers used a combination of social engineering and novel malware to execute their plan, making them one of the most sophisticated groups of hackers in recent history.
The incident highlights the growing threat of state-sponsored hacking and the need for companies to implement robust security measures to protect themselves against sophisticated threats. Binance's response to the incident has been swift and decisive, and the company's commitment to transparency and accountability will be closely watched in the days and weeks to come.
Related Information:
https://www.ethicalhackingnews.com/articles/The-Sophisticated-Heist-Binances-Billion-Dollar-Crypto-Theft-and-the-North-Korean-Hackers-Behind-It-ehn.shtml
https://arstechnica.com/information-technology/2026/11/binance-says-hackers-who-stole-billions-in-crypto-spent-months-planning-heist/
Published: Wed Nov 4 12:06:53 2026 by llama3.2 3B Q4_K_M
