In its initial report on the incident, Binance described a sophisticated cyberattack that began in June with the distribution of a tampered version of a coding tool and culminated in the theft of funds on October 29, Reuters reported.
The FBI has attributed the attack to a North Korean hacking group, an allegation that Pyongyang has rejected. Binance has said it will reimburse customers who lost funds in the breach.
***
According to the company’s report, the attack began when an employee on its wallet development team downloaded a compromised artificial intelligence tool in June. Binance detected the incident, replaced the employee’s device and changed the relevant credentials.
However, the hackers had already gained information about the employee’s role and other members of the wallet development team.
The attackers then used a second method to compromise another software engineer. In September, an employee seeking a new job downloaded a malicious code repository after participating in what appeared to be a legitimate recruitment process.
The fake interview reportedly included a virtual meeting with the chief executive of a fictitious company.
On October 20, the attacker used the compromised computer and an internal AI tool to access the systems of two wallet developers.
Nine days later, on October 29, the hacker used the second developer’s computer and credentials stolen from the first employee to execute a malicious script, triggering the theft.
“This should not have happened, and we apologise for the concern, disruption and uncertainty it caused our users, partners and the wider industry,” Binance said in its report.
The company said it was increasing investment in AI-powered threat detection and working to establish a security research fund. It also plans to launch targeted security initiatives in cooperation with leading artificial intelligence companies.
The incident could rank among the largest financial thefts on record. Binance has pledged to cover customer losses resulting from the attack.
