Binance says a months-long cyber campaign involving a tampered Homebrew installer and a fake recruitment process gave attackers access to its internal wallet-signing service. The exchange estimates that approximately $6.34 billion in cryptocurrency was stolen on October 29.
In a security report published November 3, Binance described the incident as a multi-stage operation rather than a single breach. The exchange said the first known compromise took place in June, when an engineer on its Wallet DevOps team downloaded a modified installation of Homebrew, a macOS package manager, while searching for an AI coding tool.
Binance detected unusual activity, replaced the engineer’s device and changed associated credentials. But the attackers had already learned about the engineer’s role and identified colleagues working on the exchange’s wallet infrastructure, according to the report.
In September, a second engineer was approached on a legitimate job-search platform by someone posing as a project director. The supposed recruiter arranged two interviews, including a video call with a purported HR representative who shared a social media account with personal photos and videos. The engineer was later asked to download a coding assignment from a malicious software repository. Binance said the code ran during setup and replaced a legitimate component of the Python version-management tool pvenv with malware that could execute commands and communicate with an attacker-controlled server. The exchange’s endpoint security tools did not detect it at the time.
Binance said the attackers made further progress on October 20, using compromised computers and an internal AI tool to gain control of two wallet engineers’ devices. They also found a container deployment permission token on the computer of the engineer first targeted in June.
On October 29, the attackers used stolen credentials to access another engineer’s computer, deploy a container and run a malicious script. This gave them access to Binance’s internal wallet-signing service, which they used to make transactions from five hot wallets outside the exchange’s normal withdrawal process.
The FBI attributed the theft to North Korea on November 1 and referred to the activity as “TraderTraitor.” North Korea rejected the U.S. claims, describing them as “preposterous nonsense.” Binance said it had frozen or intercepted approximately $2.85 billion in compromised assets and replenished 98% of the affected funds.
Sources: Tom's Hardware.