During the October 29 cyberattack on Binance, hackers were able to continue siphoning off cryptocurrency. They succeeded even after the exchange had blocked withdrawal options. The criminals gained unauthorized access to an internal service used to sign wallet transactions. They then exploited an Ethereum mechanism to transfer funds outside of Binance’s systems.
This is according to a preliminary investigation report published by Binance on November 3. The report indicates that the attack involved approximately $6.34 billion in digital assets. Binance states that it has since been able to freeze or intercept $2.85 billion of that amount.
Between 8:05 p.m. and 8:09 p.m. UTC, the criminals were able to transfer a total of 233.46 million XRP from five wallets to an address they controlled. Additionally, approximately 970,500 SOL and 44.2 million OP were stolen. Separately, 18,270 bitcoin were transferred.
Abuse of Ethereum authorizations
In the attack, the criminals used, among other things, EIP-7702. This mechanism allowed them to transfer certain execution rights from an Ethereum account to a smart contract without sharing the private key. The hackers used this mechanism to grant their own smart contract rights over a Binance wallet.
When Binance discovered the unauthorized transfers, it blocked the withdrawals. However, that measure had no impact on the authorizations the hackers had already recorded on the blockchain. Those remained valid.
According to the investigation report, the attackers submitted a total of fifty signing transactions to manipulate the account nonce and record the authorizations. However, Binance was unable to immediately revoke those authorizations. The wallet in question used Multi-Party Computation (MPC), meaning there was no single private key available to immediately revoke the authorizations. The organization’s security team had to develop a separate procedure.
The hackers’ final unauthorized transfer, totaling 2,961.9 ETH, was confirmed on the blockchain at 11:56 p.m. UTC. This transaction had been submitted earlier. At 12:10 a.m. on October 30, Binance successfully removed the EIP-7702 delegation.
Malware via job interview
Binance’s investigation also revealed how the hackers gained access to the internal systems. The first attack took place months ago, in June. At that time, an employee downloaded a tampered Homebrew installation for an AI coding tool. Binance detected the malware in time and replaced the computer. However, by that point, the attackers had already obtained information about the roles of employees within the wallet team.
In September, the hackers approached another developer through an existing job posting platform. They posed as employees of a company looking to hire new staff. After this developer had a video call with a so-called HR representative, a second job interview followed, this time with the alleged director. The director gave the developer an assignment that required him to download a repository.
The repository contained malicious code that was installed immediately. The malware replaced a legitimate component of a development tool with a modified version. This allowed the hackers to execute commands and establish contact with an external server. Binance’s endpoint security failed to detect the malware.
On October 20, the hackers used the infected computer and an internal AI tool to gain access to two other developers. On one of their computers, they found a token with permissions to roll out containers. On October 29, the attackers then used stolen login credentials to deploy a container and launch a malicious script. This was used to carry out the attack on the wallets.
Binance has rebuilt the affected systems and revoked the compromised login credentials. The company is having the attack further investigated by external security specialists. According to the FBI, North Korea is behind the theft.