Binance shared the report containing the first findings about the cyber attack it suffered last week.
In the statement made by the company, it was noted that this was the first report covering the current information and the improvements already made, and that the investigation process was continuing and that the findings obtained would be subject to an independent review.
It was stated in the statement that some technical details will be kept confidential in order to prevent malicious people from using this information to plan new attacks, and that they are working with independent security companies to examine the issue more comprehensively.
In the statement, it was stated that North Korea was responsible for this incident, according to the latest information shared by the Federal Bureau of Investigation (FBI).
Started with unauthorized access to internal wallet signing service
In the statement regarding the initial findings, it was stated that in the incident that occurred rapidly over multiple networks, the attacker initiated transactions outside the normal withdrawal process by gaining unauthorized access to an internal wallet signing service.
It was stated in the statement that 233.46 million XRP was sent from five hot wallets of Binance to addresses under the control of the attacker, and approximately 970 thousand 500 SOL and 44.2 million OP were transferred from hot wallets in Solana and Optimism networks, and then 18 thousand 270 BTC was transferred.
In the statement, it was stated that the attacker then exploited Ethereum's EIP-7702 authorization mechanism by using the signing service, thereby obtaining partial transaction authorization in Binance's hot wallet.
It was emphasized in the statement that Binance stopped withdrawals after receiving warnings about unusually high volume transfers and coordinated with its business partners to freeze the affected tokens, and that as a result of these efforts, assets worth $ 2.85 billion were frozen or seized.
However, it was stated in the statement that suspending withdrawal transactions could not stop all unauthorized asset movements, as malicious authorizations operate independently of the normal withdrawal infrastructure, and that these difficulties prolong the time required for the attack to be completely controlled.
"We are reviewing the incident response process, signature policy scope, and hot wallet controls, and identifying opportunities that will further strengthen our capacity to rapidly respond to threats in the future," the statement said. expressions were used.
preparation process
It was stated in the statement that the current investigation showed that the attack was a multi-stage and advanced attack campaign, and that the attack was not just a single security breach or a simple phishing attempt.
In the statement, it was noted that the attackers used a variety of techniques such as social engineering through fake job interviews, downloading malware, hijacking of in-house artificial intelligence tools, breach of endpoint security and advanced transaction authorization methods.
During the preparation of the attack, the report stated that one of the company's employees was directed to download a code repository containing malware to his work computer through a fake job interview, and that the attackers thus gained access to the employees' devices and access information.
Investments in security will be increased
The statement stated that as of November 3, Binance has rebuilt the affected wallet system in a new environment, renewed the internal AI tool and access controls, replaced the affected devices, and disabled the credentials and access keys of the relevant employees.
It was noted in the statement that the company will also ask independent cyber security experts to conduct a comprehensive review, and it was announced that investments in artificial intelligence-supported threat detection systems and endpoint security will be increased.
In the statement, it was stated that studies are being carried out to establish a research fund focusing on artificial intelligence security in blockchain environments and to support security initiatives across the sector.
