A sophisticated attack that resulted in a record-breaking $6.3 billion cryptocurrency hack began with a compromised download and a spoofed job offer, according to Binance. The world's largest cryptocurrency exchange detailed how multiple steps were required to breach its security, rather than a single isolated incident.
The initial breach occurred when a Wallet DevOps engineer, referred to as Engineer A, downloaded a tampered version of Homebrew, a package manager for macOS, which was found via a malicious search engine advertisement. Reports suggest that these deceptive ads are being used to trick users into installing malware. Binance's security team detected the anomaly, replaced the device, and rotated credentials, but the hacker had already gained exposure to Engineer A's role and colleagues on the wallet infrastructure team.
Separately, a software engineer, Engineer B, was contacted through a legitimate job platform with a fake interview process involving an imposter HR representative and CEO. The attackers presented Engineer B with an assignment that was, in fact, a repository of malicious code. This malware executed during setup, employing evasion techniques to bypass Binance's security checks.
Using Engineer B's compromised computer, the attacker then gained control over two additional machines: Engineer A's and another Wallet Software engineer's (Engineer C). On Engineer A's machine, they discovered a container deployment permission token. This token, combined with stolen credentials, allowed them to access Engineer C's computer. From there, they created a container and triggered a malicious script that initiated the hack, draining funds from wallets used for transitory funds by the exchange.
Security analysts have raised concerns about the company's internal security practices, questioning whether such a significant breach should have been possible even with social engineering tactics. The FBI has pointed to a North Korean hacking group, known as TraderTraitor, as being responsible for the attack, though North Korean officials have denied involvement.
Binance has since frozen approximately half of the stolen funds and has covered the remainder. The incident highlights the persistent threats within the digital asset space and the complex methods employed by sophisticated hacking groups.