Binance $6.3B Heist: North Korean TraderTraitor Used Fake Job Interview to Plant Malware
Binance published an incident report detailing how North Korean hackers (attributed by the FBI to TraderTraitor, linked to Lazarus Group) stole $6.3 billion in cryptocurrency on October 29, 2026 through a multi-stage campaign combining social engineering, supply chain compromise, and endpoint takeover. The campaign began in June with a malicious Homebrew installation that exposed an engineer's role on the wallet infrastructure team, followed in September by an elaborate fake job interview targeting another engineer that led to malware delivery via a poisoned code repository. The malware replaced a legitimate pyenv development tool component to establish command-and-control communication, evading Binance's endpoint security. Attackers then used a compromised internal AI tool and stolen credentials to deploy a container and execute the theft.
Detalhes técnicos
The malware performed file operations replacing /opt/homebrew/Cellar/pyenv/2.8.0/libexec/pyenv_ and /opt/homebrew/bin/pyenv with a malicious binary, then created a symlink and spawned a zsh shell to execute commands and communicate with an attacker-controlled external server. On October 20, attackers used the compromised computer and an internal AI tool to pivot to wallet DevOps Engineer A and wallet developer Engineer C. Engineer A's container deployment permission token was discovered and later used on October 29 to deploy a container on Engineer C's machine, triggering the theft script via what Binance called an "advanced transaction-authorization method."
Remediação
Binance has rebuilt the compromised wallet system and internal AI tool, replaced all affected devices, and decommissioned credentials and tokens tied to the compromised engineers. The exchange is working with law enforcement, blockchain intelligence firms, and security researchers to trace and freeze stolen assets, has hired independent cybersecurity experts for a full review, and plans to establish a security research fund focused on AI security in blockchain environments.
Linha do tempo
-
Binance $6.3B Heist: North Korean TraderTraitor Used Fake Job Interview to Plant Malware
ler a análise desta fonte ocultar
Binance published an incident report detailing how North Korean hackers (attributed by the FBI to TraderTraitor, linked to Lazarus Group) stole $6.3 billion in cryptocurrency on October 29, 2026 through a multi-stage campaign combining social engineering, supply chain compromise, and endpoint takeover. The campaign began in June with a malicious Homebrew installation that exposed an engineer's role on the wallet infrastructure team, followed in September by an elaborate fake job interview targeting another engineer that led to malware delivery via a poisoned code repository. The malware replaced a legitimate pyenv development tool component to establish command-and-control communication, evading Binance's endpoint security. Attackers then used a compromised internal AI tool and stolen credentials to deploy a container and execute the theft.
Technical Details
The malware performed file operations replacing
/opt/homebrew/Cellar/pyenv/2.8.0/libexec/pyenv_and/opt/homebrew/bin/pyenvwith a malicious binary, then created a symlink and spawned azshshell to execute commands and communicate with an attacker-controlled external server. On October 20, attackers used the compromised computer and an internal AI tool to pivot to wallet DevOps Engineer A and wallet developer Engineer C. Engineer A's container deployment permission token was discovered and later used on October 29 to deploy a container on Engineer C's machine, triggering the theft script via what Binance called an "advanced transaction-authorization method."Remediation
Binance has rebuilt the compromised wallet system and internal AI tool, replaced all affected devices, and decommissioned credentials and tokens tied to the compromised engineers. The exchange is working with law enforcement, blockchain intelligence firms, and security researchers to trace and freeze stolen assets, has hired independent cybersecurity experts for a full review, and plans to establish a security research fund focused on AI security in blockchain environments.