Binance thwarts hacker plot to steal $6,3 billion worth of cryptocurrencies
Binance details a complex, multi-stage security incident spanning several months, involving compromised developer workstations, malicious software downloads, fake interview vectors, and internal tool misuse that targeted
Binance details a complex, multi-stage security incident spanning several months, involving compromised developer workstations, malicious software downloads, fake interview vectors, and internal tool misuse that targeted billions in digital assets.
Binance says the operation began no later than June and continued until October 29, 2026. The FBI and security firm TRM Security attribute the attack to North Korean perpetrators. TRM Security is tracking the group called TraderTraitor.
In June, an engineer downloaded a hacked version of Homebrew, a computer tool. Binance tracked down the affected computer after the attackers had already learned which engineers had roles on the team that manages its wallets.
In September, another engineer received messages on a job search platform from someone pretending to represent a company. The person set up two fake interviews. In the second, the engineer was asked to download a task with malicious code, which was executed upon installation.
On October 20, the attackers used the previously compromised computer and an internal Binance AI tool to gain access to the computers of two more engineers. Nine days later, they logged into a third engineerβs computer with stolen credentials and initiated the transfers.
β³
READ ALSO
HACKS.GR / RELATED
Cyber ββAttacks & Data Breaches
Singapore Airlines confirms 46.000 bookings exposed
β
Binance wallets on Solana and Optimism sent approximately 970.500 SOL and 44,2 million OP to addresses controlled by the attackers. Another Binance wallet sent 18.270 BTC to an address controlled by them. Binance was notified internally about the large transfers and immediately began investigating the incident.
The perpetrators had gained unauthorized access to an internal Binance service that approves transactions. Through this, they gave an automated program on the cryptocurrency network, which they controlled, limited permissions to act on a Binance wallet.
Binance suspended withdrawals, worked with partners to freeze the affected cryptocurrencies, and attempted to cancel the licenses the perpetrators had created. According to the company, suspending withdrawals did not in itself stop the transfers because the licenses were already registered on the cryptocurrency network and could be used independently of the normal withdrawal process.
The cancellation of the licenses required a special process and additional time because the wallet was not based on a unique digital key. Binance says it has reserved the necessary funds to cover the loss and points to its reserves page.
TRM Security reports that the perpetrators attempted to launder the assets they transferred using the TRON and Ethereum networks.
>Stay connected with Hacks.gr
Set us as a preferred source on Google and find us on social media.
Preferred source
β
end of article
Originally published by Dev.to Security. Aggregated on AIWithGhost for educational purposes β full credit and traffic to the original publisher.