The security breach at Binance began in June when a DevOps engineer downloaded a compromised version of the Homebrew package manager. Despite the company replacing the device and rotating credentials, attackers had already mapped the exchange's internal infrastructure and identified key personnel.
In September, a second engineer was targeted via a fake job offer on a recruitment platform. The attackers conducted video interviews and requested the engineer download a coding task that contained malicious software. This malware replaced a component of the pvenv tool, allowing remote command execution.
By October 20, attackers leveraged the compromised devices to gain control over wallet engineers' systems and access container deployment tokens. On October 29, they used stolen credentials to access the internal wallet signing service, enabling unauthorized transactions from five hot wallets.
The FBI attributed the theft of over $6 billion in virtual assets to North Korea, labeling the activity as TraderTraitor. Binance reported that it has since frozen or intercepted approximately $2.85 billion in assets and replenished 98 percent of the affected funds.
