The hackers who stole billions of dollars in cryptocurrency from the Binance exchange spent months working on the theft and used both social engineering and novel malware in the process, the company said Tuesday.

The heist, which both the FBI and the TRM Security firm attributed to North Korean actors, initially targeted $6.34 billion in cryptocurrency from Binance wallets. The exchange has since frozen or intercepted $2.85 billion of that sum. Binance said it has set aside funds required to cover the loss and provided this link to a Proof of Reserves page. The $6.34 billion represents the biggest sum ever targeted in a cryptocurrency theft.

Advanced persistent threat

Binance said the people behind the heist began no later than June and continued until last Thursday, when they successfully compromised an engineer’s laptop and withdrew assets from several wallets. Like just about every organization that suffers a public, high-consequence hack, Binance said the threat actor was sophisticated and resourceful.

“Our current investigation indicates that this was a sophisticated, multi-stage campaign,” a report on the company’s investigation to date said. “It was not a single isolated breach or a simple phishing incident. The attackers combined a range of techniques, including social engineering by fake recruitment interviews, malicious software downloads, compromised internal AI tooling, endpoint compromise, and an advanced transaction-authorisation method.”

Binance said that the first incident related to the compromise likely occurred in June, when an engineer downloaded a tampered version of Homebrew. The company linked to this incident reported in May, and its security team detected the compromised laptop, but only after the malware operators obtained information about the roles of the engineer and his related colleagues on the Binance wallet infrastructure team.

In September, a separate engineer received messages through a legitimate job-hunting platform he was using. The message came from an individual posing as a project director looking to hire new employees. The purported project director arranged a first-round interview with a supposed HR representative and a second-round interview with the purported CEO of the fictitious company.

During the first interview, conducted over a video platform, the purported HR representative shared a social media account that included personal photos and videos. The second interview took place over a social chat app. During it, the engineer was instructed to download an “assignment” that linked to a code repository containing malicious code that eventually executed on the engineer’s device during the setup process.

“The malware employed sophisticated obfuscation and evasion techniques, including replacing a legitimate development tool component with a malicious version to execute commands and establish communication with an attacker-controlled external server,” Binance said. “The 0-day malware was not detected by the endpoint security protection tools at the time. The attacker also took steps to conceal the malicious activity and remove traces of the compromise, making detection and subsequent investigation more challenging.”

On October 20, the attackers used the compromised engineer’s computer and an internal AI tool to take control of two other engineer devices, including the one previously targeted with the trojanized Homebrew installer. That engineer’s wallet contained a token granting access to a container deployment.

Nine days later, between 17:15 and 19:56 UTC, the threat actor logged in to the third engineer’s device, used the stolen credential, deployed a container, and activated a script to initiate the transfer. Among other things, the attackers extended their unauthorized access to an internal wallet signing service to complete transactions outside the normal withdrawal process.

Binance continued:

Binance hot wallets on Solana and Optimism sent approximately 970,500 SOL and 44.2 million OP to attacker-controlled addresses.

Binance then received an internal alert regarding large-volume transfers and immediately began investigating.

Binance hot wallet sent 18,270 BTC to an attacker-controlled address.

The attacker then used the signing service to exploit Ethereum’s EIP-7702 authorization mechanism. EIP-7702 allows an account to delegate certain execution rights to a smart contract without exposing the private key. In this case, the attacker used that mechanism to give an attacker-controlled smart contract partial execution rights over a Binance hot wallet.

Binance immediately initiated multiple containment measures, including suspending withdrawals to restrict further outflows, coordinating with partners to freeze affected tokens, and taking steps to revoke unauthorized permissions. These efforts froze a total of $2.85 billion in assets.

However, suspending withdrawals alone could not stop all unauthorized asset movements. The malicious EIP-7702 authorizations existed on-chain and operated independently of Binance’s normal withdrawal infrastructure.The attackers submitted 50 signing transactions to manipulate the account nonce and establish malicious delegation authorizations. Once established, these authorizations enabled the attackers to continue moving assets independently of Binance’s normal withdrawal infrastructure. Binance needed additional transactions to revoke these on-chain authorizations.

The containment process involved additional technical complexities. Because the hot wallet used Multi-Party Computation (MPC), there was no single private key that could be used to immediately revoke the malicious EIP-7702 authorizations. The team therefore developed and executed a specialized procedure to revoke these authorizations, which required additional time. Furthermore, suspending withdrawals and shutting down hot wallet services did not automatically invalidate existing on-chain authorizations.

Separately, TRM Security said the attackers used various means to launder successfully transferred assets through the TRON and Ethereum blockchain networks. The methods included “a self-minted token and liquidity pool, a lending receipt token passed between wallets, and cross-chain swaps chained through two bridges.”

TRM is tracking the North Korean hacking group under the name TraderTraitor.