Binance Details $6.43B Theft via Fake Job Interviews, Trojanized Homebrew, and Compromised Internal AI Tool
Binance disclosed details of a record-setting $6.43 billion cryptocurrency theft, describing it as a multi-stage campaign rather than a single breach. The intrusion began in June 2026 when a Wallet DevOps engineer ('Engineer A') downloaded a trojanized Homebrew installer while searching for an AI tool, exposing details about his role and colleagues on the wallet infrastructure team. In September 2026, attackers used a fake recruitment scheme—posing as a 'Project Director' and conducting fake HR and CEO interviews—to trick a second engineer ('Engineer B') into downloading a malicious code repository disguised as a job assignment. The compromise escalated on October 20, 2026 when attackers abused an internal AI tool via Engineer B's compromised machine to gain control over Engineer A and a third engineer ('Engineer C'), ultimately using stolen container deployment credentials to access the internal wallet signing service and initiate unauthorized transactions on October 29, 2026.
Detalhes técnicos
The attack chain combined a supply-chain compromise (trojanized Homebrew installer), recruitment-themed social engineering across two interview rounds (HR persona and fake CEO), a malicious code repository with obfuscated/evasive code that replaced a legitimate development tool component to establish C2 communication, forensic artifact cleanup, abuse of an internal AI tool to pivot to other engineers, theft of a container deployment permission token, and unauthorized use of an internal wallet signing service to bypass normal withdrawal processes.
Remediação
Binance rebuilt the affected wallet system and internal AI tool in new environments, replaced affected devices, decommissioned compromised credentials and tokens, ran enhanced security scans across employee devices, strengthened wallet-service risk controls, enhanced AI-based behavioral anomaly detection, and worked with law enforcement and blockchain intelligence firms to trace and freeze stolen assets. Binance states it has foiled 57 suspected North Korea-linked cyber threat cases since the start of 2026, noting techniques including fake job interviews, trojanized developer tools, compromised packages/extensions, and fake video conferencing apps targeting the crypto industry.
Linha do tempo
-
Binance Details $6.43B Theft via Fake Job Interviews, Trojanized Homebrew, and Compromised Internal AI Tool
ler a análise desta fonte ocultar
Binance disclosed details of a record-setting $6.43 billion cryptocurrency theft, describing it as a multi-stage campaign rather than a single breach. The intrusion began in June 2026 when a Wallet DevOps engineer ('Engineer A') downloaded a trojanized Homebrew installer while searching for an AI tool, exposing details about his role and colleagues on the wallet infrastructure team. In September 2026, attackers used a fake recruitment scheme—posing as a 'Project Director' and conducting fake HR and CEO interviews—to trick a second engineer ('Engineer B') into downloading a malicious code repository disguised as a job assignment. The compromise escalated on October 20, 2026 when attackers abused an internal AI tool via Engineer B's compromised machine to gain control over Engineer A and a third engineer ('Engineer C'), ultimately using stolen container deployment credentials to access the internal wallet signing service and initiate unauthorized transactions on October 29, 2026.
Technical Details
The attack chain combined a supply-chain compromise (trojanized Homebrew installer), recruitment-themed social engineering across two interview rounds (HR persona and fake CEO), a malicious code repository with obfuscated/evasive code that replaced a legitimate development tool component to establish C2 communication, forensic artifact cleanup, abuse of an internal AI tool to pivot to other engineers, theft of a container deployment permission token, and unauthorized use of an internal wallet signing service to bypass normal withdrawal processes.
Remediation
Binance rebuilt the affected wallet system and internal AI tool in new environments, replaced affected devices, decommissioned compromised credentials and tokens, ran enhanced security scans across employee devices, strengthened wallet-service risk controls, enhanced AI-based behavioral anomaly detection, and worked with law enforcement and blockchain intelligence firms to trace and freeze stolen assets. Binance states it has foiled 57 suspected North Korea-linked cyber threat cases since the start of 2026, noting techniques including fake job interviews, trojanized developer tools, compromised packages/extensions, and fake video conferencing apps targeting the crypto industry.