Binance has published a postmortem explaining how attackers pulled off the largest crypto theft to date. The company says the operation took months and combined several familiar hacking techniques.
The break-in began in June. One developer downloaded a tampered installer that was apparently spread through a malicious Google search ad. That download exposed details about the engineering team and how its members worked.
A second attack arrived in September. An engineer was approached by someone posing as a recruiter. The fake recruiter set up several calls and multiple interview rounds, shared social media pages to build trust, and eventually sent a fake interview assignment.
That assignment was malware. Binance says its security team caught the first June compromise and replaced the worker’s device. Its tools missed the second attack, which deleted the pyenv executable and swapped in a malicious version.
Binance described the malware as a 0-day that used “sophisticated obfuscation and evasion techniques.” The payload replaced a legitimate development tool component and opened a backdoor to an attacker-controlled server. Endpoint protection did not flag it at the time.
The FBI has identified the intruders as a North Korean unit known as “TraderTraitor.” By October 20, that group used Binance’s own internal AI tool to take control of wallets belonging to the first engineer and a third employee.
Attackers logged into the third employee’s computer on October 29 and launched the final transfer. Binance says transactions began nearly two hours after the first unauthorized movements.
The exchange explains why it could not simply freeze the funds. Its hot wallet used Multi-Party Computation (MPC), so no single private key existed. “There was no single private key that could be used to immediately revoke the malicious EIP-7702 authorizations,” Binance wrote.
The case shows how social engineering still beats most technical defenses. A convincing recruiter page and a plausible coding test were enough to get past a major exchange’s controls.
Binance has since rebuilt parts of its security stack. The company says most of the stolen assets have already been replenished. Read the full Binance postmortem coverage at The Verge.
Related: Binance Replaces 90 Percent of the $6.3 Billion Stolen in Record Crypto Heist
The Netherlands, for internationals
One email a week: the week's news for internationals in the Netherlands, new practical guides and what changed in the cities. No spam, unsubscribe any time.
