Binance Says Hackers Used Well-Known Tricks to Carry Out a $6.34 Billion Heist

本文为原文前 6,000 字符的节选翻译，完整内容请查看原文。

For almost a decade, North Korean cybercriminals have targeted the cryptocurrency industry—large and small. While these hacks have been frequent, the country’s hackers allegedly made off with their biggest heist to date last week when $6.34 billion was siphoned from the wallets belonging to crypto exchange Binance.

近十年来，朝鲜网络犯罪分子一直将加密货币行业作为攻击目标，无论规模大小。虽然此类黑客攻击频繁发生，但据称该国黑客上周实施了迄今为止最大规模的抢劫，从加密货币交易所币安（Binance）的钱包中窃取了 63.4 亿美元。

In a new security update issued on Tuesday, Binance detailed its initial findings into how the company was compromised and hackers were able to steal billions in just 20 minutes. The hack, according to Binance, was the result of an engineer falling for a fake job interview and downloading malicious software. The hackers were then able to move through the company’s network, exploit an internal AI tool, and gain access to a wallet signing service that allowed them to make transactions outside of normal withdrawal procedures.

在周二发布的一份最新安全更新中，币安详细说明了其初步调查结果，解释了公司是如何被入侵的，以及黑客如何在短短 20 分钟内窃取数十亿美元。据币安称，此次黑客攻击源于一名工程师落入了虚假面试的陷阱并下载了恶意软件。随后，黑客得以在公司网络中穿行，利用内部人工智能工具，并获得了钱包签名服务的访问权限，从而能够绕过正常的提现程序进行交易。

“This should not have happened, and we apologize for the concern, disruption and uncertainty it caused our users, partners and the wider industry,” Binance wrote in its security update, where it also says it has set aside funds to cover the losses and has “rebuilt or replaced” internal systems impacted in the attack. “It was not a single isolated breach or a simple phishing incident,” the company says.

“这本不该发生，我们对由此给用户、合作伙伴及整个行业带来的担忧、干扰和不确定性深表歉意，”币安在安全更新中写道。公司还表示已预留资金以弥补损失，并已“重建或更换”了受攻击影响的内部系统。“这并非单一的孤立漏洞或简单的网络钓鱼事件，”该公司表示。

Although more than $6 billion was stolen from Binance accounts, almost half of this—where it was possible to do so—was frozen by parts of the cryptocurrency industry, meaning the hackers could not access the funds. However, that still leaves billions controlled by North Korea’s hackers, who have been trying to launder the stolen money into a form where it can be accessed and cashed out. That process could take months.

尽管从币安账户中窃取的金额超过 60 亿美元，但其中近一半（在可行的情况下）已被加密货币行业的部分机构冻结，这意味着黑客无法动用这些资金。然而，仍有数十亿美元被朝鲜黑客控制，他们一直试图将赃款洗白，以便能够获取并套现。这一过程可能需要数月时间。

Binance’s analysis says the hack was the accumulation of months of work by hackers, with the ultimate attack taking place on October 29. Shortly after funds started to be moved from Binance’s hot wallets, across more than 10 different blockchains, multiple cryptocurrency tracing firms attributed the attacks to the Democratic People’s Republic of Korea’s (DPRK) hackers, in particular the sophisticated TraderTraitor group that previously stole more than $1.5 billion in a separate hack last year. The FBI quickly linked TraderTraitor to the Binance hack on October 31.

币安的分析显示，此次黑客攻击是黑客数月工作的积累，最终攻击发生在 10 月 29 日。在资金开始从币安的热钱包转移到 10 多个不同的区块链后不久，多家加密货币追踪公司将此次攻击归咎于朝鲜黑客，特别是曾于去年在另一起黑客攻击中窃取超过 15 亿美元的复杂组织 TraderTraitor。10 月 31 日，美国联邦调查局（FBI）迅速将 TraderTraitor 与币安黑客攻击联系起来。

“Binance’s account aligns with what we know about the TraderTraitor playbook,” says Rafe Pilling, a senior director of threat intelligence at security company Sophos. “The attackers didn’t simply steal a wallet key. They compromised engineers, used that access to understand and move through the environment, and ultimately subverted the systems used to authorize transactions.”

“币安的描述与我们所知的 TraderTraitor 的手段相吻合，”安全公司 Sophos 的威胁情报高级总监 Rafe Pilling 表示。“攻击者不仅仅是窃取了钱包密钥。他们渗透了工程师，利用这种访问权限来了解并穿行于环境之中，最终颠覆了用于授权交易的系统。”

Binance stops short of directly blaming the TraderTraitor hackers itself; however, the company points to the FBI’s attribution to North Korea and acknowledges a prior targeting by DPRK’s cybercriminals. “Throughout 2026, Binance’s security team detected and prevented 57 suspected North Korea-linked cyber threat cases,” the company’s update says.

币安并未直接指责 TraderTraitor 黑客；然而，该公司提到了 FBI 对朝鲜的归因，并承认此前曾遭到朝鲜网络犯罪分子的攻击。“在 2026 年全年，币安安全团队检测并阻止了 57 起涉嫌与朝鲜有关的网络威胁案件，”该公司在更新中表示。

Binance says activity linked to the hack can first be traced back to June this year. At the time, its update says, an engineer the company refers to as Engineer A downloaded a “tampered Homebrew installation” they found searching online. While the company says this was detected and dealt with, information about the employee was later “exposed to the hacker.”

币安表示，与此次黑客攻击相关的活动最早可追溯到今年 6 月。当时的更新称，公司内部称为“工程师 A”的一名员工下载了其在网上搜索时发现的“被篡改的 Homebrew 安装包”。虽然公司表示该事件已被发现并处理，但该员工的信息后来还是“暴露给了黑客”。

At the start of September, Binance says another software engineer, identified only as Engineer B, was contacted on “a legitimate job-hunting platform” and then attended a video interview where the fake recruiter shared legitimate-looking social media accounts and personal photos to make them seem real. The Binance engineer progressed, unsurprisingly, to a second-round interview that was conducted using an online chat. “Near the end of the interview, Engineer B was instructed to download an ‘assignment’ containing a malicious code repository onto his work computer,” Binance’s report says.

9 月初，币安称另一名仅被称为“工程师 B”的软件工程师在“一个合法的求职平台”上被联系，随后参加了一场视频面试。面试中，假招聘人员分享了看起来很真实的社交媒体账户和个人照片，以使其显得真实可信。不出所料，这名币安工程师进入了第二轮面试，面试通过在线聊天进行。“在面试快结束时，工程师 B 被要求将一份包含恶意代码库的‘作业’下载到他的工作电脑上，”币安的报告称。

“The malware employed sophisticated obfuscation and evasion techniques, including replacing a legitimate development tool component with a malicious version to execute commands and establish communication with an attacker-controlled external server,” the company writes. It adds that hackers took steps to hide their activity, a common practice.

“该恶意软件采用了复杂的混淆和规避技术，包括用恶意版本替换合法的开发工具组件，以执行命令并与攻击者控制的外部服务器建立通信，”该公司写道。它补充说，黑客采取了措施来隐藏其活动，这是一种常见的做法。

Toward the end of October, a little more than a week before the hack, Binance says, the attackers used their access to the engineer’s machine to “gain control” over the wallet of Engineer A, who had been compromised months earlier, and “another Wallet Software Engineer C.” Then on October 29, Binance says, the attackers logged in to the computer of another staff member, Software Engineer C, and used stolen login details before launching the attack. On the evening of the theft, according to Binance, the attack unfolded quickly. “The attacker exploited unauthorized access to an internal wallet signing service to initiate transactions outside the normal withdrawal process,” the company writes.

10 月下旬，即黑客攻击发生前一周多，币安称攻击者利用他们对工程师机器的访问权限，“获得了”几个月前就已被入侵的工程师 A 以及“另一名钱包软件工程师 C”的钱包控制权。随后，币安表示，10 月 29 日，攻击者登录了另一名员工——软件工程师 C 的电脑，并使用窃取的登录信息发起了攻击。据币安称，在盗窃发生的当晚，攻击迅速展开。“攻击者利用对内部钱包签名服务的未经授权访问，发起了超出正常提现流程的交易，”该公司写道。

Sophos’s Pilling says TraderTraitor “excels” in its attacks through detailed planning and being able to understand how the services of those it hacks operate. “The initial compromise is just a foothold,” he says. “The real attack is carefully engineered around how the victim actually moves money.”

Sophos 的 Pilling 表示，TraderTraitor 通过详细的规划以及对被攻击对象服务运作方式的理解，在攻击中“表现出色”。“最初的入侵只是一个立足点，”他说。“真正的攻击是围绕受害者实际转移资金的方式精心设计的。”

While Binance says its findings are only the initial step of its investigation, security and crypto tracing experts say that the hackers are undertaking efforts to launder and cash out the stolen cryptocurrency. Since the start of 2017, according to analysis by TRM Labs, North Korean–linked hackers have stolen around $12 billion in cryptocurrency—with more than half of that coming from heists this year.

虽然币安表示其调查结果仅是调查的初步步骤，但安全和加密货币追踪专家表示，黑客正在努力洗白并套现被盗的加密货币。根据 TRM Labs 的分析，自 2017 年初以来，与朝鲜有关的黑客已窃取了约 120 亿美元的加密货币，其中超过一半来自今年的抢劫。

Despite the astronomical sums, it is unclear how much of this money makes it back to North Korea. As in the Binance case, some cryptocurrencies can be frozen and made inaccessible, while other transactions can be blocked by some cryptocurrency exchanges. Crypto tracing company Elliptic has said the lau

尽管金额巨大，但尚不清楚其中有多少资金最终回流到了朝鲜。正如币安的案例一样，一些加密货币可以被冻结并使其无法动用，而其他交易则可能被一些加密货币交易所拦截。加密货币追踪公司 Elliptic 表示，洗钱……