Details of the incident preparation
Crypto exchange Binance has released a preliminary report describing the mechanism of the cyberattack that resulted in the withdrawal of assets worth $6.34 billion. According to the company, the incident occurred on the night of 29–30 October, but the preparation process lasted approximately four months.
Start of infection: June
According to information Reuters obtained from exchange representatives, the first signs of intrusion appeared as early as June. At that time, one of Binance's employees downloaded a fake Homebrew utility file, intended for the macOS operating system, to their workstation.
Although the firm's internal security service detected suspicious activity and replaced the affected equipment, the hackers managed to gather critically important information. They identified which specific employees were responsible for the development and technical support of the platform's crypto wallets.
Social engineering stage: September
In September, the attack moved to a new stage. The intruders organised a fictitious online interview with one of Binance's specialists. Under the guise of completing a test task, they transmitted malicious code to the employee. This allowed the cybercriminals to gain access to the employee's work computer.
Execution of the plan: night of 29–30 October
After the intruders established a foothold in the system, they launched a special script on the night of 29–30 October to withdraw funds from the exchange's hot wallets, resulting in losses of $6.34 billion.
Comments
No comments yet. Be the first!