Hackers spent four months infiltrating employee computers and internal systems

AI tools exploited to attack wallet signing system

[123rf]
[123rf]

A $6.34 billion hack at Binance, the world's largest digital asset exchange, was the result of a coordinated, multi-stage attack that exploited fake job interviews and internal AI tools, the company said. Hackers spent four months systematically infiltrating employee computers and internal systems before abusing the wallet signing system to steal assets on a massive scale.

Binance released an incident investigation report Tuesday (local time), saying the attack "was meticulously prepared across multiple stages" and that the hackers "combined a range of methods, including fake job interviews, employee computer intrusions and compromise of internal AI tools."

According to the report, the attack began in June. A Binance wallet DevOps engineer — identified only as Engineer A — downloaded a malware-laced software installer while searching online for a popular AI coding tool. Binance's security team detected the anomaly, replaced the device and changed the relevant credentials. The incident, however, exposed details about the engineer's work and information belonging to members of the wallet infrastructure team to the attackers.

Reuters, citing a person familiar with the matter, reported that the hackers had placed the malicious software in search engine advertisements, positioning it above legitimate results so that the employee would download the malicious program.

In September, the hackers targeted another software engineer — Engineer B — who was looking for a new job. A hacker posing as a project manager reached out through a recruitment platform and proposed an interview. Engineer B then went through two rounds of interviews with individuals impersonating a human resources officer and a CEO. The company the hackers presented turned out to be entirely fictitious.

To avoid raising suspicion, the hackers shared social media accounts with personal photos and videos. They then tricked Engineer B into downloading malware disguised as an interview assignment, gaining access to the work computer. The malware replaced existing development programs with malicious files that communicated with external servers, and Binance's security systems failed to detect it at the time.

The attack did not stop there. On Oct. 20, the hackers used Engineer B's computer and Binance's internal AI tools to take control of systems belonging to Engineers A and C. In the process, they also obtained deployment access that allowed programs to be pushed to servers from Engineer A's machine.

On Thursday — when the actual hack occurred — the hackers accessed Engineer C's computer using credentials stolen from Engineer A and executed malicious scripts to begin draining assets in earnest. Because only a handful of engineers had wallet access, the attackers had methodically secured credentials from multiple employees before finally breaching the core wallet system.

The asset theft that followed was swift. According to Binance, between 8:05 p.m. and 8:09 p.m. Thursday — a window of just four minutes — about 233.46 million XRP tokens were transferred from five hot wallets to attacker-controlled addresses. Approximately 970,500 Solana tokens, about 44.2 million Optimism tokens and 18,270 Bitcoin were subsequently moved to attacker addresses as well.

Investigators found that the attackers had exploited EIP-7702, Ethereum's account-delegation feature. EIP-7702 allows specific execution permissions to be delegated to a smart contract without directly exposing a private key. The hackers used this to grant a smart contract under their control partial execution rights over Binance's hot wallets.

Binance halted withdrawals and moved to freeze affected assets immediately after receiving an internal alert about the large-scale asset movement. Even so, outflows continued after the suspension, because the permission delegations the hackers had set on the blockchain operated independently of the exchange's normal withdrawal system. The attackers used 50 signed transactions to manipulate nonces — the counters that manage transaction sequencing on an account — and establish the malicious delegations.

Binance said the affected hot wallets used multi-party computation, which made it difficult to revoke the malicious permissions immediately. Because the structure does not allow a single private key to revoke access, time was lost while a separate response procedure was put in place.

Binance has so far frozen or blocked the movement of about $2.85 billion in assets. Total assets affected by the incident are estimated at about $6.34 billion. The exchange said it will cover all losses suffered by affected customers in full, adding that as of Saturday it had replenished 98 percent of the affected token assets using its own funds and is continuing to purchase the remaining lower-liquidity assets.

North Korea has been identified as the party behind the attack. The US Federal Bureau of Investigation recently announced that North Korea was responsible for the incident. Binance said it has detected and blocked 57 cyberattacks this year suspected of being linked to North Korea. Pyongyang has denied the allegations.

In the immediate aftermath, Binance rebuilt the compromised wallet systems and internal AI tools, replaced the relevant employees' devices and credentials, and conducted security checks across all staff devices. The company has also strengthened AI-based anomaly detection and wallet service risk management. It plans to pursue independent verification by outside experts and expand investment in AI security, and is considering establishing a blockchain security research fund in collaboration with major AI companies and cybersecurity firms.

"This incident should never have happened," Binance said. "We sincerely apologize for the concern and disruption it has caused to our users, partners and the broader industry."


kyoung@heraldcorp.com