Hackers linked to North Korea carried out a multistage attack lasting about five months, affecting $6.34 billion (about 8.4 trillion won) worth of crypto assets at Binance, the world's largest cryptocurrency exchange. Binance said it froze or blocked $2.85 billion (about 3.8 trillion won) of that amount and covered more than 98% of the losses.
In a preliminary investigation report released on the 3rd (local time), Binance explained that the hackers launched a supply chain attack in June and then widened the stages of their attack, moving on to social engineering and then penetration of internal systems. Their methods, including fake job interviews, the spread of malicious software and abuse of the company's internal artificial intelligence (AI) tools, grew more sophisticated over time.
According to the report, in September the hackers contacted a Binance engineer on a job-seeking platform. After gaining trust by posing as a job interview, they had the engineer install malware-laden software on a work computer under the pretext of doing an assignment. Using the infected computer as a foothold, they got into the internal AI tools and also obtained other employees' accounts and authentication keys used to deploy programs.
The actual withdrawal of assets took place on October 29. The hackers first drained 233.46 million XRP, then made unauthorized withdrawals of 970,500 Solana (SOL), 44.2 million Optimism (OP), 18,270 bitcoin and 2,961.9 ether, among others. In withdrawing ether, they used 'EIP-7702', a technology that hands over approval authority, to skip the normal withdrawal procedure.
About four hours after the attack began, Binance reset the relevant code to prevent any further outflow. The frozen or blocked assets were the result of a joint response by the exchange and the issuers.
Binance's own funds, the Secure Asset Fund for Users (SAFU) and a futures insurance fund, among others, were used to cover the losses. Binance plans to rebuild the compromised systems, conduct an external security audit and increase investment in AI-based threat detection technology.