A programming assignment from a potential employer seems like an ordinary part of a job interview. In reality, it was part of a cyberattack that lasted for several months, ultimately resulting in the theft of $6.3 billion from Binance, raising questions about how exchanges protect their employees from such threats.

According to the post-event analysis released on Tuesday by Binance, this attack was part of a coordinated effort, with attackers taking advantage of both human vulnerabilities and internal security systems. The investigation results from the exchange detail how the hackers gradually gained access to its wallet infrastructure before the theft on October 29th.

According to the security report from Binance, this attack began in June. At that time, an engineer downloaded a tampered software package while setting up a AI programming tool. Although Binance detected the malware and replaced the affected devices, the attackers had already collected information about the wallet team of that exchange.

In September, attackers posing as recruiters targeted another software engineer, tricking them into downloading a malicious file disguised as a programming assignment. This malware infected the engineer's work computer and managed to bypass the security measures of the exchange.

On October 20th, the attackers utilized this compromised computer and an internal AI tool to further gain access into the systems of two other engineers, obtaining deployment credentials. On October 29th, they used these credentials to install malware within the wallet infrastructure of Binance.

Subsequently, the attackers obtained access to the exchange's internal wallet signing service. This service is responsible for authorizing cryptocurrency transactions, which allowed them to transfer funds bypassing the normal withdrawal process.

Co-CEO Binance stated on X on Tuesday: "This is not a mistake, nor is it a single intrusion – it is an operation that has been ongoing for several months." Richard Teng

Binance indicates that the attackers also took advantage of Ethereum's EIP-7702 mechanism. This mechanism allows wallets to delegate transaction permissions to smart contracts, enabling unauthorized transfers to continue even after exchanges suspend withdrawals. Its multi-party computation (MPC) decentralizes the control over transaction signatures, which also makes it more complicated to revoke these permissions.

According to the latest calculations by Binance, this intrusion affected approximately $6.3 billion in digital assets, of which $2.85 billion has been frozen or intercepted. The exchange stated that it will bear the losses itself and will not pass them on to customers. It also mentioned that as of October 31st, 98% of the affected token assets have been recovered.

The Federal Bureau of Investigation (FBI) attributed this attack, the largest cryptocurrency hacking incident in history, to North Korean hackers. On Tuesday, Kim Yo-jong, the sister of North Korean leader Kim Jong-un, denied her country's involvement and stated that such attributions are politically motivated, aimed at damaging North Korea's international reputation.

Magazine: Binance Hackers raced against time to transfer billions of dollars before their funds were frozen