Binance 2026-yil 29-oktabrda taxminan 6,34 milliard dollarlik raqamli aktivlarni o'g'irlash uchun soxta ishga qabul qilish intervyulari, buzilgan dasturchi qurilmalari va zararli blokcheyn avtorizatsiyalarini o'z ichiga olgan murakkab sxemadan foydalanilganini ma'lum qildi.
Birjaning dastlabki xulosalariga ko'ra, bu muvofiqlashtirilgan hujum ichki hamyon imzo xizmatiga yetib borgan va odatdagi yechib olish nazoratlarini chetlab o'tgan ruxsatsiz tranzaksiyalarni amalga oshirishga imkon bergan. FBI o'g'irlikni Shimoliy Koreyaning TraderTraitor faoliyat klasteriga bog'ladi.
Binance o'g'irlangan aktivlarning taxminan 2,85 milliard dollari muzlatilgan yoki ushlab qolinganini, bu esa bozor o'zgaruvchanligiga bog'liq ravishda muvofiqlashtirishni kutayotganini ma'lum qildi. Kompaniya moliyaviy ta'sirni o'z zimmasiga olishga va'da berdi va 31-oktabrgacha ta'sirlangan token aktivlarining 98 foizini to'ldirganini aytdi.
Hujum tayyorgarligi o'g'irlikdan bir necha oy oldin boshlangan. Iyun oyida Wallet DevOps muhandisi AI kodlash vositasini o'rnatishga urinayotganda buzilgan Homebrew o'rnatuvchisini yuklab olgan. Binance qurilmani almashtirgan va ma'lumotlarni aylantirgan, ammo tergovchilar bu hodisa muhandis va uning hamkasblarini fosh qilgan deb hisoblashadi.
Shunga o'xshash soxta Homebrew o'rnatuvchi kampaniyalari ishonchli veb-saytlar va manipulyatsiya qilingan o'rnatish buyruqlari yordamida macOS tizimlarini buzgan.
Sentyabr oyida hujumchilar boshqa bir muhandisga qonuniy ishga qabul qilish platformasi orqali murojaat qilgan. Go'yoki loyiha direktori HR vakili va kompaniya bosh direktorini taqlid qilgan shaxslar bilan intervyular tashkil qilgan.
Birinchi intervyu oluvchi ishonchni qozonish uchun jonli video va shaxsiy fotosuratlarni o'z ichiga olgan ijtimoiy tarmoq akkauntidan foydalangan. Ikkinchi intervyu davomida muhandis topshiriq omborini ish kompyuteriga yuklab olgan.
Sozlash jarayonida zararli kod ishga tushib, haqiqiy pyenv komponentini o'zgartirilgan bajariladigan fayl bilan almashtirgan. Skript pyenv_ yaratgan, asl binarni o'chirgan, almashtirishni qayta nomlagan, ramziy havolani qayta yaratgan va zsh ni ishga tushirgan.
20-oktabrda hujumchilar buzilgan ish stansiyasi va ichki AI vositasidan foydalanib, yana ikki muhandisning kompyuteriga kirgan. Ular DevOps muhandisining qurilmasida konteyner joylashtirish ruxsat tokenini topgan.
29-oktabrda, UTC vaqti bilan 17:15 dan 19:56 gacha, hujumchilar boshqa muhandisning kompyuteriga kirgan, o'g'irlangan ma'lumotlardan foydalangan, konteyner joylashtirgan va zararli skriptni ishga tushirgan.
Ruxsatsiz o'tkazmalar 233,46 million XRP, taxminan 970 500 SOL, 44,2 million OP va 18 270 BTC ni o'z ichiga olgan.
Bu ketma-ketlik ishga qabul qilish orqali dasturchilarni buzish qanday qilib ma'lumotlarni fosh qilishi va imtiyozli infratuzilmaga kirish yo'llarini yaratishi mumkinligini ko'rsatadi.
Keyinchalik hujumchilar buzilgan imzo xizmati orqali Ethereum'ning EIP-7702 avtorizatsiya mexanizmini suiiste'mol qilib, hujumchi nazoratidagi shartnomaga issiq hamyon ustidan bajarish huquqlarini bergan.
Bu zanjirdagi ruxsatlar Binance yechib olishni to'xtatganidan keyin ham amal qilgan. Birja hujumchilar hisob nonceslarini manipulyatsiya qilish va zararli delegatsiyalarni o'rnatish uchun 50 ta imzo tranzaksiyasini yuborganini aytdi.
Hamyon Ko'p Tomonli Hisoblash (Multi-Party Computation) dan foydalanganligi sababli, javob beruvchilarda darhol bekor qilish uchun yagona shaxsiy kalit yo'q edi va maxsus protsedura ishlab chiqildi.
2 961,9 ETH ni o'z ichiga olgan oxirgi ruxsatsiz o'tkazma UTC vaqti bilan 23:56 da yakunlandi. Binance Binance14 delegatsiyasini 30-oktabrda UTC vaqti bilan 00:10 da tozaladi.
Binance ta'sirlangan tizimlarni qayta qurdi, qurilmalarni almashtirdi, ma'lumotlarni bekor qildi va monitoringni kuchaytirdi. Uning tergovi davom etmoqda. FBI'ning atributsiya xabari hujumchilar o'g'irlangan aktivlarni asosan ETH ga aylantirib, keyin markazlashmagan moliya va tez almashtirish xizmatlari orqali yuvishayotganini ogohlantiradi.
SOC'ingizga hodisalarni tez to'xtatish uchun ogohlantirish kontekstini bering.16K SOC'dan tahdid razvedkasini integratsiya qiling.
Binance has revealed that attackers carried out a sophisticated scheme involving fake recruitment interviews, compromised developer endpoints, and malicious blockchain authorizations to steal approximately $6.34 billion in digital assets on October 29, 2026.
The exchange’s initial findings indicate a coordinated intrusion that reached its internal wallet signing service, enabling unauthorized transactions that bypassed normal withdrawal controls. The FBI has linked the theft to North Korea’s TraderTraitor activity cluster.
Binance reported that around $2.85 billion of the stolen assetshad been frozen or intercepted, pending reconciliation and subject to market volatility. The company committed to absorbing the financial impact and stated it had replenished 98% of the affected token assets by October 31.
The attack preparation began months before the theft. In June, a Wallet DevOps engineer downloaded a tampered Homebrew installer while attempting to install an AI coding tool. Binance replaced the device and rotated credentials, but investigators believe the incident exposed the engineer and their colleagues.
Similar fake Homebrew installer campaigns have used convincing websites and manipulated installation commands to compromise macOS systems.
In September, attackers approached another engineer through a legitimate recruitment platform. A supposed project director arranged interviews with individuals impersonating an HR representative and a company CEO.
The first interviewer used live video and a social media account containing personal photographs to establish credibility. During the second interview, the engineer downloaded an assignment repository onto his work computer.
Malicious code executed during setup, replacing the legitimate pyenv component with an altered executable. The script created pyenv_, removed the original binary, renamed the replacement, recreated a symbolic link, and spawned zsh.
On October 20, the attackers used the compromised workstation and an internal AI tool to reach two additional engineers’ computers. They discovered a container deployment permission token on the DevOps engineer’s device.
On October 29, between 17:15 and 19:56 UTC, the intruders accessed another engineer’s computer, used the stolen credentials, deployed a container, and triggered a malicious script.
Unauthorized transfers included 233.46 million XRP, approximately 970,500 SOL, 44.2 million OP, and 18,270 BTC.
The sequence illustrates how recruitment-driven developer compromises can expose credentials and create routes into privileged infrastructure.
Attackers subsequently abused Ethereum’s EIP-7702 authorization mechanism through the compromised signing service, granting an attacker-controlled contract execution rights over a hot wallet.
These on-chain permissions remained effective after Binance suspended withdrawals. The exchange said attackers submitted 50 signing transactions to manipulate account nonces and establish malicious delegations.
Because the wallet used Multi-Party Computation, responders lacked a single private key for immediate revocation and developed a specialized procedure.
The final unauthorized transfer, involving 2,961.9 ETH, finalized at 23:56 UTC. Binance cleared the Binance14 delegationat 00:10 UTC on October 30.
Binance rebuilt affected systems, replaced devices, revoked credentials, and strengthened monitoring. Its investigation remains ongoing. The FBI’s attribution notice warns that attackers are converting stolen assets primarily into ETH before laundering them further through decentralized finance and instant-swap services.
Give your SOC the alert context to stops incidents quickly.Integrate Threat Intel from 16K SOCs.
