Binance Releases Investigation on $6.34 Billion Breach Involving Internal AI Tool
Enterprise AI
Binance released a preliminary report on its October 29 cyber incident involving $6.34 billion in stolen assets. Attackers infiltrated via tampered installers and fake job interviews, leveraging an internal AI tool to access wallet signing authorities. Binance pledged to cover the losses.
Cryptocurrency exchange Binance released an initial investigation report on November 3 regarding a major cyber incident on October 29, which resulted in the unauthorized transfer of approximately $6.34 billion in digital assets. The report detailed a sophisticated multi-stage operation spanning months. In June, an engineer downloaded a compromised developer tool installer, exposing internal team identities. In September, attackers used a fake interview process to execute a zero-day malware payload on another employee's workstation. Attackers then leveraged an internal AI tool for lateral movement to obtain deployment tokens, ultimately accessing hot wallets and exploiting Ethereum's EIP-7702 authorization. Binance stated it would absorb all losses and has replenished the majority of affected funds.
Key takeaways
- Binance's preliminary probe revealed attackers breached systems via tampered installers and fake interview assignments executing zero-day malware.
- The perpetrators leveraged an internal AI tool as a pivot to escalate access, deploy containers, and transfer tokens including Bitcoin and XRP.
- Attackers abused Ethereum's EIP-7702 authorization against an MPC hot wallet, requiring custom procedures by Binance to clear delegations.
- Binance committed to covering all losses and rebuilding its wallet environment, while the FBI attributed the attack to North Korea's TraderTraitor group.
Source：數位時代 Read the original ↗
Prepared, checked and automatically published by AI; not individually reviewed by a human. Translation checked by AI.