Binance said Tuesday (Nov. 3) that last week’s $6.34 billion hack of its cryptocurrency exchange resulted from a sophisticated, multi-stage campaign that began in June.

Complete the form to unlock this article and enjoy unlimited free access to all PYMNTS content — no additional logins required.

In its initial report on the security incident, Binance said “attackers spent months working their way into its systems through a supply chain compromise, fake job interviews and an internal AI tool before taking control of hot wallets.”

Key steps in the hackers’ campaign included an engineer on Binance’s wallet infrastructure team downloading a tampered installer while setting up a popular AI coding tool in June; a second Binance engineer being approached on a legitimate job platform and downloading malware that was included in a coding “assignment” during what turned out to be a fake job interview in September; the attackers using the compromised computer to find a container deployment permission on another Binance wallet engineer’s machine on Oct. 20; and the attackers using stolen credentials to deploy a container and launch the attack Thursday (Oct. 29), according to the report.

Binance said in the report that it is keeping some technical details confidential to avoid helping future attackers.

Binance also said that before this attack, its security team had detected and blocked 57 other suspected North Korea-linked threats this year.

“Binance is engaging independent cybersecurity firms to review the incident and validate its findings, increasing investment in AI-based security, and working to set up a security research fund with AI companies and security firms focused on AI security in blockchain,” the company said in the report.

Source link