"North Korean Hackers Approached Binance Employees and Planted Malware After Stealing Cryptocurrency"

North Korean hackers were found to have carried out a sophisticated, multi-stage attack over a five-month period starting in June to hack the cryptocurrency exchange Binance.

Binance released an initial investigation report detailing these findings on the 3rd (local time).

The report stated that the incident involved malicious software supply chain attacks, internal AI tool hacking, and even social engineering techniques.

The attackers first launched a supply chain attack back in June by luring Engineer A, who was in charge of developing and operating Binance's cryptocurrency wallets, into downloading a tampered development tool.

At the time, Binance's security team detected suspicious signs and took measures such as replacing the device and renewing authentication credentials, but the personal information of wallet infrastructure team members was exposed to the hackers.

Approximately three months later in September, North Korean hackers approached Engineer B through a job platform, launching a social engineering attack by conducting a fake hiring process.

During the first video interview, the interviewer used deception tactics to build trust with B, such as sharing a social networking service (SNS) account containing photos of their personal life.

In the second interview, an individual posing as the chief executive officer (CEO) had B download software containing malware onto their work computer under the guise of performing an assignment.

The malware exploited a zero-day vulnerability that went undetected by security tools at the time, replacing legitimate development tools with malicious versions.

Using B's computer infected in this manner, the hackers abused internal AI tools on October 20 to gain control over A and Engineer C step by step, ultimately securing the program distribution authentication key (container deployment authority token) held by A.

On October 29, the day of the theft, North Korean hackers logged into C's computer and used A's authentication key to deploy programs they had created, carrying out the attack.

The hackers first made unauthorized withdrawals of 233.46 million Ripple (XRP) over a 4-minute period starting at 8:05 PM Coordinated Universal Time (UTC) (5:05 AM on the 30th, Korea time), followed by the transfer of 970,500 Solana (SOL) and 44.2 million Optimism (OP).

They then transferred 18,270 Bitcoins and 2,961.9 Ethereums.

Notably, during the Ethereum network attack, they abused an authorization privilege called 'EIP-7702,' bypassing normal withdrawal infrastructure by receiving delegation authentication for asset withdrawals through 50 pre-arranged signatures.

Binance initialized the EIP-7702 delegation code at 12:10 AM on the 30th (9:10 AM, Korea time), about four hours after the attack began, to block further outflows, but a substantial amount of cryptocurrency had already been stolen.

Binance has rebuilt the compromised wallets and internal AI tools, and is conducting security audits with external independent institutions.

The total value of digital assets affected by this incident is $6.34 billion (8.4 trillion won), of which $2.85 billion (approx. 3.8 trillion won) has been frozen or blocked through cooperation between exchanges and issuers.

Furthermore, Binance covered more than 98% of the losses resulting from this incident by mobilizing its own retained funds, the Secure Asset Fund for Users (SAFU), and the futures insurance fund.

Binance stated that, taking this incident as an opportunity, it is expanding investments in AI-based detection technology and pursuing the establishment of an AI security research fund for the digital asset environment in collaboration with major AI companies.

Binance added that throughout 2026, it has detected and blocked 57 cyber threat cases suspected of being linked to North Korea.
※ Please note: This article was translated by AI and may contain errors.