Binance je inace objavio postmortem u kojem objasnjavaju kako je doslo do hacka. Naime, prvo je jedan od zaposlenika jos u Lipnju skinuo malware (i to tako da je trazio nekakav AI tool, a Google mu na vrhu ponudio lazni) a onda je u Rujnu drugi zaposlenik pao na foru da su mu se javili kobajagi poslodavci te je tijekom intervjua za posao morao odraditi nekakav zadatak te je pritom ne znajuci skinuo nekakav malware.
Kuzim da su metode hackera sve naprednije, ali ne ide mi u glavu da zaposlenici Binancea koji rade na tako osjetljivim mjestima ocito koriste isti komp i za posao, i za svoje privatne stvari. I to tehnicki potkovana ekipa a ne neki Apu iz customer supporta koji cesto manje zna od onih koji ga kontaktiraju da rijesi problem.
Tekst je poduzi, ja sam zalijepio samo najosnovnije dijelove.
Our current investigation indicates that this was a sophisticated, multi-stage campaign. It was not a single isolated breach or a simple phishing incident. The attackers combined a range of techniques, including social engineering by fake recruitment interviews, malicious software downloads, compromised internal AI tooling, endpoint compromise, and an advanced transaction-authorisation method.
June 2026 — Supply chain attack. Engineer A from Wallet DevOps downloaded a tampered Homebrew installation in order to install a popular AI coding tool after searching for it on a search engine. Our security team detected the anomaly, replaced the device, and rotated all related credentials as a proactive security action. However, Engineer A’s role and his related colleagues on our wallet infrastructure team was exposed to the hacker.
September — social engineering. Software Engineer B was contacted through a legitimate job-hunting platform by an individual posing as a Project Director. Software Engineer B had a profile on the platform that referenced his experience at Binance. The purported Project Director arranged a first-round interview with a HR representative, followed by a second-round interview with an individual claiming to be the CEO of a fictitious company.
In the first round, the purported HR representative conducted a live video interview with Software Engineer B. The interviewer shared a social media account with him, including personal photos and videos posted on the platform, in order to build trust. This was more advanced and deceptive than previously seen social engineering approaches.
The second interview was conducted in a popular social chat app, near the end of the interview, Engineer B was instructed to download an “assignment” containing a malicious code repository onto his work computer. The repository contained malicious code that executed during the setup process, initiating a series of unauthorized activities.
The malware employed sophisticated obfuscation and evasion techniques, including replacing a legitimate development tool component with a malicious version to execute commands and establish communication with an attacker-controlled external server. The 0-day malware was not detected by the endpoint security protection tools at the time. The attacker also took steps to conceal the malicious activity and remove traces of the compromise, making detection and subsequent investigation more challenging.
