Binance o‘tgan haftadagi 6,34 milliard dollarlik o‘g‘rilik ortida turgan xakerlar uning hamyon imzolash tizimlariga bir necha oy davom etgan kampaniya natijasida yetib kelganini aytdi. Kampaniya uchta muhandisning kompyuterlarini buzib kirgan, ulardan biri soxta ish intervyusi orqali buzilgan.
Birja 3-noyabrda dastlabki hodisa hisobotini e’lon qildi. O‘g‘irlangan aktivlarning taxminan 2,85 milliard dollari muzlatilgan yoki to‘xtatilgan.
"Bu sodir bo‘lmasligi kerak edi va biz foydalanuvchilarimiz, hamkorlarimiz va kengroq sanoatga yetkazilgan xavotir, uzilish va noaniqlik uchun uzr so‘raymiz", — dedi Binance.
FBI o‘g‘rilikni Shimoliy Koreya davlat homiyligidagi xakerlar guruhi TraderTraitor ayblagan.
Hujum qanday rivojlandi
Binance ma’lumotiga ko‘ra, hujum bosqichma-bosqich rivojlangan va soxta yollovchilar, zararli yuklamalar, xodimlar kompyuterlarining egallanishi va ichki AI vositasiga tayangan. "Bu yagona alohida buzilish yoki oddiy fishing hodisasi emas edi", — deb ta’kidladi kompaniya.
Kampaniya iyun oyida, Wallet DevOps muhandisi qidiruv tizimi orqali mashhur AI kodlash vositasini qidirayotganda buzilgan Homebrew o‘rnatmasini yuklab olganida boshlangan.
Binance xavfsizlik jamoasi buni aniqladi, uning qurilmasini almashtirdi va tegishli ma’lumotlarni qayta o‘rnatdi. Shunga qaramay, hujumchilar u nima qilayotgani va hamyon infratuzilmasi jamoasida kim bilan ishlayotgani haqida ma’lumotga ega bo‘lib ulgurishgan.
Sentyabrda ikkinchi muhandisga loyiha direktori deb da’vo qilgan shaxs murojaat qilgan. U ikki intervyuga taklif qilingan: birinchisi soxta HR vakili bilan, ikkinchisi esa mavjud bo‘lmagan kompaniyaning go‘yoki bosh direktori bilan.
Birinchi intervyu davomida HR soxtakori shaxsiy fotosuratlar va videolarni o‘z ichiga olgan ijtimoiy tarmoq akkauntini ulashib, ishonch qozonishga harakat qilgan. Ikkinchisi chat ilovasi orqali o‘tgan va ish kompyuteriga kodlash "topshirig‘i"ni yuklab olish so‘rovi bilan yakunlangan.
Topshiriq zararli kod omborini yashirgan, u muhandis uni o‘rnatishi bilan darhol ishga tushgan. Zararli dastur qonuniy ishlab chiquvchi vosita komponentining soxta nusxasini almashtirgan va hujumchilar tomonidan boshqariladigan serverga kanal ochgan.
"0-day zararli dastur o‘sha paytda endpoint xavfsizlik himoya vositalari tomonidan aniqlanmagan", — dedi Binance.
20-oktyabrda hujumchilar zararlangan mashina va ichki AI vositasidan foydalanib, birinchi muhandisning tizimi va uchinchi hamyon muhandisining tizimini nazoratga olgan. Hisobotda AI vositasi qanday ishlatilgani tushuntirilmagan.
Birinchi muhandisning kompyuterida konteyner joylashtirishga ruxsat beruvchi token saqlangan. 29-oktyabrda hujumchilar uchinchi muhandisning kompyuteriga kirishgan, birinchi muhandisdan olingan ma’lumotlar bilan konteyner joylashtirgan va zararli skript bilan hujumni boshlagan.
Binance aytishicha, hujumchilar ichki hamyon imzolash xizmatiga ruxsatsiz kirishdan foydalanib, XRP, SOL, OP va BTC ni issiq hamyonlardan olib chiqqan. Xuddi shu xizmat Ethereum’ning EIP-7702 mexanizmini suiiste’mol qilish uchun ishlatilgan, bu esa hujumchilar nazoratidagi shartnomaga issiq hamyon ustidan qisman bajarish huquqlarini bergan.
"Biroq, faqat yechib olishni to‘xtatish barcha ruxsatsiz aktiv harakatlarini to‘xtata olmagan. Zararli EIP-7702 avtorizatsiyalari zanjirda mavjud bo‘lgan va Binance’ning odatiy yechib olish infratuzilmasidan mustaqil ravishda ishlagan", — deb tushuntirdi kompaniya.
Issiq hamyon ko‘p tomonlama hisoblash (MPC) bilan himoyalangan, bu Binance’ning delegatsiyani darhol bekor qilish uchun foydalanishi mumkin bo‘lgan yagona kalitga ega emasligini anglatgan. Oxirgi ruxsatsiz o‘tkazma 23:56 UTC da yakunlangan va delegatsiya yarim tundan keyin tez orada tozalangan.
Binance ta’sirlangan hamyon tizimi va AI vositasini qayta qurganini, qurilmalarni almashtirganini va muhandislarning ma’lumotlari va tokenlarini bekor qilganini aytdi. U hodisani tekshirish uchun mustaqil xavfsizlik firmalarini jalb qilmoqda va blokcheyn muhitlarida AI xavfsizligiga qaratilgan tadqiqot fondi ustida ishlamoqda.
Birja shuningdek, bu yil Shimoliy Koreya bilan bog‘liq 57 ta shubhali tahdidni aniqlagan va to‘xtatganini ma’lum qildi.
Boshqa yangiliklar
Shimoliy Koreya FBI’ning o‘g‘rilikni TraderTraitor xakerlariga bog‘lashini rad etdi. "Bu AQShning turli dunyo qismlaridagi barcha kiberjinoyatlar bizning ishimiz deb xalqaro jamoatchilik fikrini chalg‘itadigan og‘ir siyosiy provokatsiyadir", — dedi davlat OAVlari orqali tarqatilgan bayonotda rahbar Kim Jong Unning singlisi Kim Yo Jong.
O‘qing: [Shimoliy Koreya Binance o‘g‘riligi da’volariga norozilik sifatida dengizga raketalar uchirdi]
Binance shuningdek, 31-oktyabr zaxira holati uchun nol-bilim isbotini yakunladi, bu 10 ta asosiy token egalariga ularning balanslari kamida 1:1 nisbatda qo‘llab-quvvatlanishini tekshirish imkonini beradi. Bosh direktor Richard Teng 3-noyabrda ta’sirlangan tokenlarning 98 foizi endi to‘ldirilganini aytdi.
Teng shuningdek, 3-noyabrda yechib olishlar keng miqyosda qayta tiklanganini aytdi. Birja ularni 1-noyabrda bosqichma-bosqich qayta ochishni boshlagan.
Pul yuvish frontida Elliptic o‘g‘irlangan mablag‘lar to‘rt kundan kamroq vaqt ichida 11 ta blokcheynda taxminan 12 000 hamyondan o‘tganini, avtomatlashtirish ishlatilganini, ammo AI agentlari qaror qabul qilganiga hech qanday belgi yo‘qligini aytdi. 3-noyabr holatiga ko‘ra, taxminan 3,18 milliard dollar o‘g‘rilik bilan bog‘liq manzillarda qolgan. Alohida, Chainalysis THORChain’dagi favqulodda to‘xtash, bu bilan bog‘liq bo‘lmagan texnik muammo tufayli yuzaga kelgan, pul yuvishni vaqtincha sekinlashtirganini aytdi.
Bog‘liq: Chainalysis AI tomonidan boshqariladigan kiberhujumdan so‘ng ma’lumotlar buzilishini oshkor qildi
Bog‘liq: DebugBear DNS egallanishini keltirgan holda Polymarket savdogarlarga 3,9 million dollarni qaytardi
Binance says the hackers behind last week’s$6.34 billion theftreached its wallet signing systems after a months-long campaign that compromised three engineers’ computers, one of them through a fake job interview.
The exchange published its initial incident report on November 3. Roughly $2.85 billion of the stolen assets has been frozen or intercepted.
“This should not have happened, and we apologise for the concern, disruption and uncertainty it caused our users, partners and the wider industry,” Binance said.
The FBI has blamed the theft on TraderTraitor, a North Korean state-sponsored hacking group.
How the attack unfolded
According to Binance, the intrusion unfolded in stages and relied on fake recruiters, malicious downloads, hijacked employee computers and an internal AI tool. “It was not a single isolated breach or a simple phishing incident,” the company noted.
The campaign started in June, when a Wallet DevOps engineer downloaded a tampered Homebrew installation while looking for a popular AI coding tool through a search engine.
Binance’s security team caught it, swapped out his device and reset the related credentials. Even so, the attackers had already gained insight into what he did and who he worked with on the wallet infrastructure team.
In September, a second engineer was approached by someone claiming to be a project director. He was invited to two interviews, the first with a fake HR representative and the second with the alleged CEO of a company that did not exist.
During the first interview, the HR impostor shared a social media account containing personal photos and videos to build rapport. The second took place over a chat app and ended with a request to download a coding “assignment” onto his work computer.
The assignment hid a malicious code repository that executed as soon as the engineer set it up. The malware substituted a rogue copy of a legitimate developer tool component and opened a channel to a server run by the attackers.
“The 0-day malware was not detected by the endpoint security protection tools at the time,” Binance said.
On October 20, the attackers used the infected machine and an internal AI tool to gain control of the first engineer’s system and a third wallet engineer’s system. The report does not explain how the AI tool was used.
The first engineer’s computer held a token that allowed container deployments. On October 29, the attackers signed into the third engineer’s computer, deployed a container with credentials taken from the first engineer and kicked off the attack with a malicious script.
Binance says the attackers exploited unauthorized access to an internal wallet signing service to move XRP, SOL, OP and BTC out of its hot wallets. The same service was used to abuse Ethereum’s EIP-7702 mechanism, giving a contract under the attackers’ control partial execution rights over a hot wallet.
“However, suspending withdrawals alone could not stop all unauthorized asset movements. The malicious EIP-7702 authorizations existed on-chain and operated independently of Binance’s normal withdrawal infrastructure,” the company explained.
The hot wallet was secured with multi-party computation (MPC), which meant Binance had no single key it could use to cancel the delegation right away. The last unauthorized transfer settled at 23:56 UTC, and the delegation was cleared shortly after midnight.
Binance says it has rebuilt the affected wallet system and AI tool, replaced devices and retired the engineers’ credentials and tokens. It is engaging independent security firms to review the incident and is working on a research fund focused on AI security in blockchain environments.
The exchange also disclosed that it had detected and blocked 57 suspected North Korea-linked threats this year.
Other developments
North Korea has rejected the FBI’s attribution of the heist to its TraderTraitor hackers. “It is a grave political provocation against the DPRK that the US misleads international public opinion as if all the cyber crimes in different parts of the world are our deeds,” Kim Yo Jong, sister of leader Kim Jong Un, said in a statement carried by state media.
Read: [North Korea Launches Missiles Toward the Sea to Protest Binance Hack Claims]
Binance has also completed a zero-knowledge proof for its October 31 reserves snapshot, which lets holders of 10 major tokens verify that their balances are backed at least 1:1. Co-CEO Richard Teng says 98% of the impacted tokens have now been replenished.
Teng also said on November 3 that withdrawals have broadly resumed. The exchange began reopening them in phases on November 1.
On the laundering front, Elliptic says the stolen funds passed through about 12,000 wallets on 11 blockchains in under four days, using automation but with no sign of AI agents making decisions. As of November 3, roughly $3.18 billion remained in theft-linked addresses. Separately, Chainalysis said an emergency pause at THORChain, triggered by an unrelated technical issue, had temporarily slowed the laundering.
Related:Chainalysis Discloses Data Breach Following AI-Driven Cyberattack
Related:Polymarket Returns $3.9 Million to Traders as DebugBear Cites DNS Hijack