Binance has revealed how North Korean hackers spent months preparing to steal approximately $6.34 billion in cryptocurrency last week. According to a November 3 security report by the exchange, the attackers used a malicious Homebrew installation to compromise one engineer and a fake recruitment process to trick another into installing malware disguised as a coding assistant. "Our current investigation indicates that this was a sophisticated, multi-stage campaign. It was not a single isolated breach or a simple phishing incident," the exchange said.

Binance says the first known compromise occurred in June, when an engineer in Binance’s Wallet DevOps team searched online for a popular AI coding tool and downloaded an adulterated Homebrew installation. Homebrew is a package manager, used by developers to install and manage various software tools on macOS.

Binance says it detected the unusual activity, replaced the engineer’s device, and rotated their associated credentials. However, those moves proved to be too little, too late, as the attackers had already learned about the employee’s role and identified colleagues working on the exchange's wallet infrastructure

The incident follows the compromise of another Binance software engineer who was contacted in September through a legitimate job hunting platform by a malicious actor posing as a project director. The fake recruiter arranged two interviews. One involved a purported HR representative who conducted a live video call and shared a social media account containing personal photos and videos to establish credibility, while the second involved someone posing as a CEO of a fictitious company.

Source link