Binance Confirms North Korean TraderTraitor Group Stole $6.34 Billion via Fake Job Interview Social Engineering
Binance published an incident report attributing the October 29 theft of approximately $6.34 billion in cryptocurrency to North Korean state-sponsored hackers tracked as TraderTraitor, Lazarus Group, Jade Sleet, and APT38. The attack began in September when a software engineer was approached on a legitimate job-hunting platform by a fake recruiter posing as a Project Director, who scheduled two fake interviews (HR and CEO impersonators) to build trust before delivering a malicious coding assignment via an online code repository. Executing the assignment deployed a previously unseen, undetected custom malware on the employee's macOS device, which the attackers used to pivot internally, eventually compromising two more employees working on Binance's wallet infrastructure and obtaining credentials and a container deployment token. On October 29, the stolen credentials were used to deploy a malicious script granting access to Binance's wallet signing service, enabling cross-chain transfers of billions in assets, with attackers abusing Ethereum's EIP-7702 authorization mechanism to continue stealing funds even after withdrawals were suspended.
Detalhes técnicos
The malware replaced the legitimate pyenv executable in the macOS Homebrew installation directory with a malicious binary named pyenv_, deleted the original, renamed the malicious file to pyenv, and modified its symbolic link to spawn a zsh process that executed commands from an attacker-controlled server. The malware used sophisticated obfuscation and evasion techniques and was not detected by endpoint security tools at the time of the intrusion. Attackers also leveraged an internal AI tool on the compromised engineer's machine to assist in compromising additional staff.
Remediação
Binance rebuilt affected systems, replaced compromised devices, and revoked stolen credentials. As of November 3, about $2.85 billion of stolen assets had been frozen or intercepted, and 98% of impacted token assets had been replenished as of October 31. Binance has engaged independent security firms to continue the investigation.
Linha do tempo
-
Binance Confirms North Korean TraderTraitor Group Stole $6.34 Billion via Fake Job Interview Social Engineering
ler a análise desta fonte ocultar
Binance published an incident report attributing the October 29 theft of approximately $6.34 billion in cryptocurrency to North Korean state-sponsored hackers tracked as TraderTraitor, Lazarus Group, Jade Sleet, and APT38. The attack began in September when a software engineer was approached on a legitimate job-hunting platform by a fake recruiter posing as a Project Director, who scheduled two fake interviews (HR and CEO impersonators) to build trust before delivering a malicious coding assignment via an online code repository. Executing the assignment deployed a previously unseen, undetected custom malware on the employee's macOS device, which the attackers used to pivot internally, eventually compromising two more employees working on Binance's wallet infrastructure and obtaining credentials and a container deployment token. On October 29, the stolen credentials were used to deploy a malicious script granting access to Binance's wallet signing service, enabling cross-chain transfers of billions in assets, with attackers abusing Ethereum's EIP-7702 authorization mechanism to continue stealing funds even after withdrawals were suspended.
Technical Details
The malware replaced the legitimate pyenv executable in the macOS Homebrew installation directory with a malicious binary named pyenv_, deleted the original, renamed the malicious file to pyenv, and modified its symbolic link to spawn a zsh process that executed commands from an attacker-controlled server. The malware used sophisticated obfuscation and evasion techniques and was not detected by endpoint security tools at the time of the intrusion. Attackers also leveraged an internal AI tool on the compromised engineer's machine to assist in compromising additional staff.
Remediation
Binance rebuilt affected systems, replaced compromised devices, and revoked stolen credentials. As of November 3, about $2.85 billion of stolen assets had been frozen or intercepted, and 98% of impacted token assets had been replenished as of October 31. Binance has engaged independent security firms to continue the investigation.