A cyber hacking group under the command of the North Korean regime carried out a meticulous, multi-stage attack over five months against the world's largest virtual-asset exchange, Binance Holdings Ltd., and siphoned off a large amount of funds.
On the 3rd (local time), Binance Holdings Ltd. released an initial investigation report with these findings. According to Binance Holdings Ltd., the incident combined sophisticated social-engineering techniques, the abuse of internal artificial intelligence (AI) tools, and exploitation of gaps in the latest Blockchain technology.
Since June, the North Korean hacking group laid the groundwork for infiltration by securing internal personnel information in advance through a "supply chain attack" that lured a wallet developer into downloading a tampered program. In September, it also carried out a "social engineering attack" by approaching another wallet engineer via a job-seeking platform.
In the first video interview, they posed as an HR manager and carefully broke down the employee's guard by sharing a social networking service (SNS; Social Network Service) containing personal photos. In the second interview, an individual impersonating the company's chief executive officer (CEO; Chief Executive Officer) appeared and, under the pretext of an assignment, induced the installation of malicious software on a work PC.
The installed malware exploited a vulnerability undetected by antivirus programs, swapped out legitimate development tools for malicious versions, and began communicating with an external server. Having seized the engineer's PC, the North Korean hackers on the 20th of last month abused an internal AI tool as a beachhead to gradually expand their privileges on the internal network.
Through this, they sequentially obtained control over the accounts of other core engineers. Ultimately, they got their hands on a critical authentication key that could directly deploy programs to the wallet system.
With the acquired privileges, the hackers on the 29th of last month used the stolen authentication key to distribute a malicious script and carried out a large-scale withdrawal of funds. In particular, they abused "EIP-7702," the latest signature technology in Ethereum that enables delegated authority.
They used a method of transferring wallet execution authority to a prearranged smart contract, showing persistence by siphoning funds in succession independently on the Blockchain even after Binance Holdings Ltd. detected anomalies and suspended the exchange's own withdrawal function.
The total virtual assets stolen in this incident amount to $6.34 billion (about 8.7 trillion won). Binance Holdings Ltd. immediately blocked an outflow worth $2.85 billion through swift freezing measures and emergency cooperation with major issuers and exchanges.
To minimize customer damage, more than 98% of the losses were covered with its own fund and reserves. Binance Holdings Ltd. plans to rebuild its internal AI tools and wallet infrastructure from the ground up and conduct security audits through external institutions, while significantly strengthening related security investments such as AI-based anomaly detection.
