Binance seshanba kuni dunyodagi eng yirik kriptovalyuta birjasidan 6,43 milliard dollar aktivning rekord darajadagi o'g'irlanishi "murakkab, ko'p bosqichli kampaniya" natijasi bo'lganini aytdi. Bu kampaniya buzilgan Homebrew o'rnatish va ikkita muhandisiga qaratilgan ishga yollash mavzusidagi ijtimoiy muhandislik hujumini o'z ichiga olgan.
"Bu yagona alohida buzilish yoki oddiy fishing hodisasi emas edi," deb aytdi kompaniya. "Hujumchilar turli usullarni birlashtirdilar, jumladan, soxta ishga yollash suhbatlari orqali ijtimoiy muhandislik, zararli dasturiy ta'minot yuklab olishlari, ichki AI vositalarining buzilishi, yakuniy nuqta buzilishi va ilg'or tranzaksiya avtorizatsiya usuli."
Boshlang'ich nuqta Wallet DevOps jamoasidan bir muhandis ("Muhandis A" deb nomlangan) ga qaratilgan ta'minot zanjiri hujumiga borib taqaladi. U qidiruv tizimida qidirgandan so'ng, mashhur sun'iy intellekt (AI) vositasini o'rnatish uchun trojanlashtirilgan Homebrew o'rnatuvchisini yuklab olgan. Hodisa 2026-yil iyun oyida sodir bo'lgan.
Binance hujumni aniqlaganini va barcha tegishli ma'lumotlarni ehtiyot chorasi sifatida aylantirganini aytgan bo'lsa-da, kompaniya "Muhandis A ning roli va uning hamkasblari haqida ma'lumot xakerga fosh bo'lganini" aytdi.
Hujumning ikkinchi qismi 2026-yil sentyabr oyida sodir bo'ldi. Tahdid aktori boshqa muhandis ("Muhandis B" deb nomlangan) bilan haqiqiy ish qidirish platformasi orqali bog'lanib, o'zini mavjud bo'lmagan kompaniyaning Loyiha Direktori sifatida ko'rsatdi.
Loyiha Direktori shaxsi birinchi tur suhbatini inson resurslari (HR) vakili bilan tashkil qildi, keyin esa o'zini mavjud bo'lmagan kompaniya bosh direktori deb tanishtirgan shaxs bilan ikkinchi tur suhbatini o'tkazdi. Binance soxta kompaniya tafsilotlarini oshkor qilmadi.
Birinchi tur video suhbat davomida HR vakili ijtimoiy tarmoqdagi akkauntni, jumladan, platformada joylashtirilgan shaxsiy fotosuratlar va videolarni ulashdi — bu ishonchni mustahkamlash va ishonchni o'rnatish maqsadida qilingan. Ikkinchi tur esa mashhur ijtimoiy chat ilovasida bo'lib o'tdi.
"Suhbatning oxiriga yaqin, Muhandis B ga ish kompyuteriga zararli kod omborini o'z ichiga olgan 'topshiriq'ni yuklab olish buyurildi," deb aytdi Binance. "Ombor o'rnatish jarayonida bajariladigan zararli kodni o'z ichiga olgan bo'lib, bu ruxsatsiz faoliyatlar seriyasini boshladi."
Aniqlanmagan zararli dastur ilg'or yashirish va chetlashish usullaridan foydalandi, jumladan, buyruqlarni bajarish va hujumchi nazoratidagi tashqi server bilan aloqa o'rnatish uchun qonuniy ishlab chiquvchi vosita komponentini zaharlangan versiya bilan almashtirish. Bundan tashqari, tahdid aktori buzilish bilan bog'liq sud-tibbiy artefaktlarni o'chirish orqali izlarni yashirish choralarini ko'rdi.
Buzilish 2026-yil 20-oktabrda keyingi bosqichga o'tdi. Dushman Muhandis B ning buzilgan kompyuteridan foydalandi va ichki AI vositasidan foydalanib, Muhandis A va boshqa Hamyon Dasturiy Ta'minot Muhandisi C ni nazorat qilishga erishdi.
"Hujumchi tez orada Wallet DevOps Muhandisi A ning kompyuterida konteyner joylashtirish ruxsat tokeni borligini aniqladi," deb tushuntirdi Binance. "29-oktabrda 17:15 dan 19:56 gacha hujumchi Dasturiy Ta'minot Muhandisi C ning kompyuteriga kirdi, Wallet DevOps Muhandisi A dan o'g'irlangan ma'lumotlardan foydalandi, konteyner joylashtirdi va hujumni boshlash uchun zararli skriptni ishga tushirdi."
Hujum oxir-oqibat ichki hamyon imzolash xizmatiga ruxsatsiz kirishdan foydalanib, normal yechib olish jarayonidan tashqarida tranzaksiyalarni boshladi.
Hodisaga javoban Binance ta'sirlangan hamyon tizimini yangi muhitda qayta qurdi, shuningdek, ichki AI vositasi va kirish nazoratlarini qayta qurdi. 3-noyabr holatiga ko'ra qilingan boshqa choralar quyida keltirilgan:
- Ta'sirlangan qurilmalar almashtirildi.
- Ta'sirlangan muhandislarga tegishli ma'lumotlar va tokenlar bekor qilindi.
- Barcha xodim qurilmalarida kengaytirilgan xavfsizlik tekshiruvlari yakunlandi.
- AI asosidagi xulq-atvor anomaliyasini aniqlash kuchaytirildi.
- Hamyon xizmati xavf nazorati mustahkamlandi.
- Ta'sirlangan aktivlarni kuzatish va muzlatish uchun huquqni muhofaza qiluvchi organlar, blokcheyn razvedka firmalari va soha hamkorlari bilan ishlashdi.
"Hujumda foydalanilgan kirish nuqtalari yopildi. Hujum yo'lida tegishli tizimlar qayta qurildi yoki almashtirildi," deb aytdi Binance. "Shuningdek, biz qurilma nazoratini kuchaytirdik, hamyon xizmati xavf nazoratini kuchaytirdik va AI asosidagi xulq-atvor anomaliyasini aniqlashni kengaytirdik."
"Biz AI yordamida aniqlash, yakuniy nuqta himoyasi, ishlab chiquvchi muhit xavfsizligi va xulq-atvor anomaliyasi monitoringiga sarmoyani oshirmoqdamiz."
Yil boshidan beri Binance Shimoliy Koreya bilan bog'liq 57 ta shubhali kiber tahdid holatini bartaraf etgan deb baholanmoqda. Bu kriptovalyuta sohasiga qaratilgan hujumlarning doimiy tabiatini ta'kidlaydi.
"Usullar orasida soxta ish suhbatlari, mashhur ishlab chiquvchi vositalari sifatida niqoblangan zararli dasturiy ta'minot, buzilgan dasturiy paketlar va brauzer kengaytmalari, soxta video konferensiya ilovalari va ma'lumotlarni o'g'irlash yoki masofaviy kirish zararli dasturini joylashtirish uchun mo'ljallangan ijtimoiy muhandislik kampaniyalari bor," deb aytdi Binance.
Binance on Tuesday said the record-setting theft of $6.43 billion in assets from the world's largest cryptocurrency exchange was the culmination of a "sophisticated, multi-stage campaign" that involved the use of a tampered Homebrew installation and recruitment-themed social engineering attack targeting two of its engineers.
"It was not a single isolated breach or a simple phishing incident," the company said. "The attackers combined a range of techniques, including social engineering by fake recruitment interviews, malicious software downloads, compromised internal AI tooling, endpoint compromise, and an advanced transaction-authorisation method."
The starting point has been traced back to a supply chain attack targeting one of its engineers from the Wallet DevOps team (named "Engineer A"), who downloaded a trojanized Homebrew installer to install a popular artificial intelligence (AI) tool after searching for it on a search engine. The incident occurred in June 2026.
Although Binance said it detected the attack and rotated all related credentials as a precautionary step, the company said information about "Engineer A's role and his related colleagues on our wallet infrastructure team was exposed to the hacker."
The second part of the attack occurred in September 2026, with the threat actor contacting another engineer (named "Engineer B") via a legitimate job-hunting platform by disguising themselves as a Project Director.
The Project Director persona arranged a first-round interview with a human resources (HR) representative, which was then followed by a second-round interview with an individual claiming to be the CEO of a non-existent company. Binance did not disclose details of the fake company.
Over the course of the first-round video interview, the HR representative shared a social media account, including personal photos and videos posted on the platform, in an attempt to build credibility and establish trust. The second round, on the other hand, took place on a popular social chat app.
"Near the end of the interview, Engineer B was instructed to download an 'assignment' containing a malicious code repository onto his work computer," Binance said. "The repository contained malicious code that executed during the setup process, initiating a series of unauthorized activities."
The undetected malware utilized advanced obfuscation and evasion techniques, including substituting a legitimate development tool component with a poisoned version to execute commands and establish communication with an attacker-controlled external server. In addition, the threat actor took steps to cover up tracks by removing forensic artifacts related to the compromise.
The intrusion moved to the next stage on October 20, 2026, when the adversary leveraged Engineer B's compromised computer and abused an internal AI tool to gain control over Engineer A and another Wallet Software Engineer C.
"The attacker soon discovered Wallet DevOps Engineer A had a container deployment permission token on his computer," Binance explained. "On 29 October between 17:15 and 19:56, the attacker logged onto Software Engineer C's computer, used the credentials stolen from Wallet DevOps Engineer A, deployed a container, and triggered a malicious script to launch the attack."
The attack ultimately exploited its unauthorized access to an internal wallet signing service to initiate transactions outside the normal withdrawal process.
In response to the incident, Binance has reconstructed the affected wallet system in a new environment, as well as rebuilt the internal AI tool and access controls. Other steps taken as of November 3 are listed below -
- Replaced affected devices.
- Decommissioned credentials and tokens related to affected engineers.
- Completed enhanced security scans across all employee devices.
- Enhanced AI-based behavioural anomaly detection.
- Strengthened wallet-service risk controls.
- Worked with law enforcement, blockchain intelligence firms, and industry partners to trace and freeze affected assets.
"The entry points identified as having been used in the attack have been closed. Systems touched in the attack path have been rebuilt or replaced," Binance said. "We have also implemented tighter device controls, enhanced wallet-service risk controls and expanded AI-based behavioural anomaly detection."
"We are increasing investment in AI-enabled detection, endpoint protection, developer-environment security and behavioural anomaly monitoring."
Since the start of the year, Binance is estimated to have foiled 57 suspected North Korea-linked cyber threat cases, underscoring the persistent nature of the attacks targeting the cryptocurrency industry.
"The techniques include fraudulent job interviews, malicious software disguised as popular developer tools, compromised software packages and browser extensions, fake video conferencing applications, and social engineering campaigns designed to steal credentials or deploy remote access malware," Binance said.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.