Four hours to loot Binance: the crypto platform reveals what really happened during the cyberattack

Five days after the biggest theft in the history of cryptocurrencies, Binance publishes a first investigative report on the cyberattack. At the end of a preliminary investigation, the platform reveals how hackers managed to penetrate its wallets in order to steal more than 6 billion dollars. According to Binance, it all started with a simple job interview.

Binance returned in detail to the cyberattack blitz which stripped it of more than $6 billion in cryptocurrencies. The industry giant begins by apologizing to its users “for the concern, disruption and uncertainty” resulting from the theft, and recalls that nearly $2.85 billion in stolen cryptos have been frozen or intercepted. Binance once again assures that it will absorb all losses, and that 98% of the affected assets have already been replenished as of October 31.

According to investigations carried out by Binance, the heist was prepared for months. The first traces of the operation date back to June. Early this summer, an engineer on the wallet team at Binance began looking for an AI coding tool on a search engine. Without realizing it, he ended up downloading a tricked version of Homebrew, a tool widely used by developers. Binance's security team quickly spotted the anomaly and replaced the engineer's professional computer. Unfortunately, the virus, housed in the code of the fake Homebrew, managed to get its hands on information relating to the engineer's work. The hackers now know what his exact job is, and that of several of his colleagues.

In September, a second engineer was targeted by the pirates. He was contacted on a job search platform by a fake “project director”. Without suspecting the deception, he has a first video interview with a supposed recruiter. This fake recruiter even shows him his personal photos and videos on social networks to gain his trust. During a second online interview, the developer meets the CEO of a fictitious company. He is then invited to download an “exercise” on his work computer. The file contains unknown malware, which manages to bypass the machine's security tools. Upon installation, the virus discreetly replaces pyenv, a very common tool among Python developers, with a tricked version. This malicious version receives orders in real time from a server under the control of cybercriminals.

On October 20, nine days before the heist, the hackers attacked with an internal AI tool. Hackers use artificial intelligence as a springboard to move from the hacked computer to the machine of two other engineers. Binance remains quite evasive on the method used by the hackers. Quite logically, the exchange platform warns that “certain technical details will remain confidential” so as not to help other hackers carry out attacks. On one of the hacked computers, the crooks got their hands on an access token that allows software to be deployed on Binance infrastructure.

Machine-translated from French