Binance says a series of security breaches, beginning with a tampered Homebrew download and followed by a fake job interview, enabled an attacker to steal $6.3 billion from wallets used to hold the exchange’s transitory funds. The company described the incident as a multi-stage attack rather than a single breach or simple phishing attempt.
According to Binance, a Wallet DevOps engineer, identified as Engineer A, downloaded a modified Homebrew installation suggested by a search engine. Homebrew is a third-party package manager for macOS. Binance says its security team detected unusual activity, replaced the device and changed related credentials, but the attacker had already gained exposure to the engineer’s role and colleagues on the wallet infrastructure team.
A separate approach targeted Engineer B through a legitimate job-hunting platform. The engineer was invited to interviews with people posing as a company’s HR representative and CEO. Binance says the supposed employer was fictitious, and an assignment given to Engineer B contained malicious code that ran during setup and used techniques to avoid detection.
The attacker then used Engineer B’s compromised computer and an internal AI tool to access two other machines: Engineer A’s and that of another wallet software engineer, identified as Engineer C. Binance says a container deployment permission token found on Engineer A’s device helped the attacker use stolen credentials to access Engineer C’s computer, create a container and run a malicious script that initiated the theft.
The FBI has attributed the attack to a North Korean hacking group, an accusation North Korean officials have denied, according to the report. Binance says it has frozen roughly half of the stolen funds and covered the remainder.
Sources: PC Gamer.