Binance Discloses Investigation Report on $6.3 Billion Cryptocurrency Theft Incident
Binance's official blog published a preliminary investigation report explaining how hackers stole $6.3 billion worth of cryptocurrency. The attack began in June of this year, when a wallet DevOps engineer downloaded a tampered Homebrew installer from a search engine in order to install a popular AI programming tool; in September, the attacker again impersonated a project director on a legitimate job platform, conducted two rounds of video interviews with another engineer, and implanted malicious code in the form of an assignment containing a code repository. In October, the attacker used the compromised computer and internal AI tools to control other engineers' devices, and ultimately on October 30 used stolen credentials to deploy containers and execute malicious scripts to launch the attack.
Why read this
AI score 71
Binance officially reviewed the complete attack chain, from tampered installation packages to fake interviews and then lateral movement through internal AI tools, which can serve as a reference for supply chain and social engineering risks.
Topics
Body · AI translation
The official Binance blog disclosed a preliminary investigation report on how hackers stole $6.3 billion in cryptocurrency. The report states that the attack began in June of this year: June 2026 — Supply chain attack. Engineer A from the wallet DevOps team searched via a search engine and downloaded a tampered Homebrew installer in order to install a popular AI programming tool. Our security team proactively detected this anomaly, replaced the device, and rotated all related credentials. Nevertheless, Engineer A's role information, as well as information about related colleagues in the wallet infrastructure team, had already been exposed to the attackers.
September — Social engineering attack. Software Engineer B was contacted through a legitimate job platform by someone impersonating a project director. Engineer B's profile on the platform mentioned their work experience at Binance. The other party, posing as the project director, arranged a first-round interview involving a human resources representative; then arranged a second-round interview with someone claiming to be the CEO of the fictitious company.
In the first-round interview, the person impersonating the HR representative conducted a real-time video interview with Engineer B. To build trust, the interviewer also shared their social media accounts with Engineer B, whose platform accounts contained photos and videos of their personal life. This approach was more sophisticated and deceptive than previous social engineering attack methods.
In the second-round interview, conducted via a popular social chat app, Engineer B was asked near the end to download a "homework assignment" containing a code repository onto their work computer. The code repository contained malicious code that executed during installation, thereby triggering a series of unauthorized operations.
The malware employed sophisticated code obfuscation and detection evasion techniques, including replacing a legitimate development tool component with a malicious version to execute commands and establish communication with an external server controlled by the attackers. At the time, endpoint security protection tools failed to detect this zero-day malware. The attackers also took measures such as concealing malicious activity and erasing traces of intrusion, further increasing the difficulty of detection and subsequent investigation.
October 20 — Using internal AI tools as an attack springboard. The attackers used the compromised computer of Engineer B to control, through internal AI tools, the devices of wallet DevOps Engineer A and another wallet software engineer, C. The attackers quickly discovered that Engineer A's computer contained a token with container deployment privileges.
October 30 — Penetrating wallet signing operations. Between 01:15 and 03:56 on October 30 (UTC+8), the attackers logged into software engineer C's computer, used credentials stolen from Engineer A to deploy a container, and executed malicious scripts, thereby launching this attack.