Hackers who pulled off the largest attempted cryptocurrency theft on record against Binance spent months preparing the operation, relying on a mix of social engineering and previously unseen malware, the exchange said Tuesday.
The attackers initially went after $6.34 billion in cryptocurrency held in Binance wallets, the biggest sum ever targeted in a crypto theft. Both the FBI and security firm TRM Security have attributed the campaign to North Korean actors. Binance said it has frozen or intercepted $2.85 billion of the targeted amount.
The company said it has reserved the funds needed to cover the loss and pointed customers to its Proof of Reserves page as evidence.
According to Binance, the operation began no later than June and ran until last Thursday, when the attackers successfully compromised an engineer's laptop and withdrew assets from several wallets.
"Our current investigation indicates that this was a sophisticated, multi-stage campaign," the company wrote in a report on its investigation so far. "It was not a single isolated breach or a simple phishing incident."
The report said the attackers layered multiple techniques, including social engineering carried out through fake recruitment interviews, malicious software downloads, compromised internal AI tooling, endpoint compromise and what the company described as an advanced transaction-authorisation method.
Binance said the earliest incident tied to the breach likely took place in June, when an engineer downloaded a tampered version of Homebrew, a widely used software package tool. The company referenced a related incident that was publicly reported in May.
The exchange's security team eventually detected the compromised laptop, but only after the malware's operators had already gathered information about the engineer's role and about colleagues who work alongside him on the Binance wallet infrastructure team.
Like many organizations that suffer a public and damaging breach, Binance characterized the threat actor as sophisticated and resourceful, a description the company used to explain how the campaign evaded detection for months.
The investigation remains ongoing, and the company's report reflects only its findings to date.
