Binance’s hot-wallet hack followed months of infiltration
Binance’s account describes a staged intrusion involving engineers and wallet authorization systems. Co-CEO Richard Teng said the attackers spent months gaining access, rejecting the idea that one employee’s laptop represented a single point of failure.
A Binance security report traced preparations to June, when an engineer downloaded a tampered Homebrew installation while seeking an AI coding tool. Binance detected suspicious activity, replaced the device and rotated credentials, but said the engineer’s role and colleagues had already been exposed.
In September, attackers posing as recruiters put another engineer through interviews and a coding exercise containing hidden malware, Teng said. They then moved through internal AI tools to reach the system authorizing wallet transactions.
Teng said Binance had replenished 98% of affected assets and was purchasing the remaining, less-liquid assets. Customers withdrew $3.6 billion when the exchange reopened on November 1. Binance pledged to cover customer losses and rebuilt the affected wallet system and internal AI tool.
Lichtenstein emphasized the first 48 hours after an attack as critical for tracing stolen funds. Artificial intelligence can accelerate transfers after a theft, adding urgency to early tracking.
Article produced with the assistance of artificial intelligence and reviewed by the editorial team.
Leave a Reply