Binance reveals the $6.34 billion hack chain involving malware and an internal SI tool
Prepared by Sintelligent with the help of SI. Published in SI: . Updated: .
Internal SI tools are becoming part of critical infrastructure: compromising one can connect employee deception with access to operations worth billions of dollars.
According to Binance, preparations began in June: an engineer installed a tampered version of Homebrew while searching for a popular SI coding tool. In September, another employee went through a series of fake job interviews and downloaded malware during a coding exercise. On October 20, the attackers used the compromised computer and an internal SI tool to access the systems of two wallet developers; on October 29, they launched a malicious script using stolen credentials. Binance said it had frozen or intercepted $2.85 billion of the stolen $6.34 billion and replenished 98% of the affected assets. The wallet system and internal SI tool were rebuilt, and the associated devices, tokens, and credentials were replaced.
Sources 2