Cryptocurrency exchange Binance reported that the cyber attack it suffered last week was not limited to a single security breach or a simple phishing attempt, but was carried out as part of a multi-stage and advanced attack campaign.
Binance published its report containing the first findings regarding the cyber attack that took place last week.
In the statement made by the company, it was stated that the report covers the information obtained so far and the security improvements implemented. It was noted that the investigation is continuing and the findings will be subject to an independent review.
It was stated in the statement that some technical details would not be shared with the public in order to prevent the attackers from making new attempts, and that cooperation was being made with independent security companies for a comprehensive investigation of the incident.
In the statement, it was reported that North Korea was behind the attack, according to the latest information shared by the US Federal Bureau of Investigation (FBI).
The attack started with unauthorized access to the internal wallet signing service
According to Binance's initial findings, the attacker gained unauthorized access to the company's internal wallet signing service and made transactions outside of the usual withdrawal processes. Within the scope of the attack, high amount of asset transfers were made in a short time over multiple blockchain networks.
In the statement, it was stated that 233.46 million XRP was transferred from five hot wallets belonging to Binance to addresses controlled by the attacker. It was reported that approximately 970 thousand 500 SOL and 44.2 million OP were transferred from hot wallets in Solana and Optimism networks, and then 18 thousand 270 BTC were sent to other addresses.
It was noted that the attacker then exploited Ethereum's EIP-7702 authorization mechanism by taking advantage of the internal signing service and obtained partial transaction authorization in one of Binance's hot wallets.
It was stated that Binance stopped withdrawals after receiving warnings about unusually large transfers and coordinated with its business partners to freeze the affected tokens.
As a result of these efforts, it was announced that a total of $2.85 billion in assets were frozen or seized.
However, it was stated that suspending withdrawals could not prevent all unauthorized asset movements, as malicious authorizations operate independently of the normal withdrawal infrastructure. It was reported that this situation extended the time required for the attack to be completely brought under control.
"We are reviewing the incident response process, signature policy scope and hot wallet controls, and identifying opportunities that will further strengthen our capacity to respond quickly to threats in the future," the company said in its statement.
Fake job interviews and artificial intelligence tools were used in the attack
Binance stated that the ongoing investigation revealed that the attack was an advanced operation consisting of multiple stages.
In the statement, it was stated that the attackers applied social engineering methods through fake job interviews, exploited malware, hijacked in-company artificial intelligence tools and violated endpoint security. It was also noted that advanced transaction authorization techniques were used in the attack.
According to the report, in preparation for the attack, one of the company's employees was directed to download a code repository containing malware to his work computer through a fake job interview.
It was reported that the attackers accessed the employees' devices and access information using this method.
Binance will increase security investments
In the statement made by the company, it was stated that as of November 3, the wallet system affected by the attack was recreated in a new environment.
In this context, it was stated that the in-house artificial intelligence tool and access controls were renewed, the affected devices were replaced, and the credentials and access keys of the relevant employees were disabled.
It was stated in the statement that Binance will request a comprehensive review from independent cyber security experts, and it was announced that investments in artificial intelligence-supported threat detection systems and endpoint security will be increased.
It was also noted that studies are being carried out to establish a research fund focusing on artificial intelligence security in blockchain environments and to support security initiatives across the sector.
