Binance says hackers who stole billions in crypto spent months planning heist

本文为原文前 6,000 字符的节选翻译，完整内容请查看原文。

The hackers who stole billions of dollars in cryptocurrency from the Binance exchange spent months working on the theft and used both social engineering and novel malware in the process, the company said Tuesday. The heist, which both the FBI and the TRM Security firm attributed to North Korean actors, initially targeted $6.34 billion in cryptocurrency from Binance wallets.

币安周二表示，从该交易所窃取数十亿美元加密货币的黑客在盗窃过程中花费了数月时间进行策划，并同时使用了社会工程学和新型恶意软件。此次盗窃案被美国联邦调查局（FBI）和 TRM Security 公司归咎于朝鲜黑客，最初的目标是币安钱包中价值 63.4 亿美元的加密货币。

The exchange has since frozen or intercepted $2.85 billion of that sum. Binance said it has set aside funds required to cover the loss and provided this link to a Proof of Reserves page. The $6.34 billion represents the biggest sum ever targeted in a cryptocurrency theft.

该交易所此后已冻结或拦截了其中 28.5 亿美元。币安表示，已预留资金以弥补损失，并提供了指向“储备金证明”页面的链接。这 63.4 亿美元是有史以来加密货币盗窃案中涉及的最大金额。

Binance said the people behind the heist began no later than June and continued until last Thursday, when they successfully compromised an engineer’s laptop and withdrew assets from several wallets. Like just about every organization that suffers a public, high-consequence hack, Binance said the threat actor was sophisticated and resourceful.

币安表示，此次盗窃案的幕后黑手最早于 6 月就开始行动，一直持续到上周四，当时他们成功入侵了一名工程师的笔记本电脑，并从多个钱包中提取了资产。正如几乎所有遭受公开、高后果黑客攻击的组织一样，币安称该威胁行为者手段高明且足智多谋。

“Our current investigation indicates that this was a sophisticated, multi-stage campaign,” a report on the company’s investigation to date said. “It was not a single isolated breach or a simple phishing incident. The attackers combined a range of techniques, including social engineering by fake recruitment interviews, malicious software downloads, compromised internal AI tooling, endpoint compromise, and an advanced transaction-authorisation method.”

“我们目前的调查显示，这是一场复杂的多阶段行动，”一份关于该公司迄今为止调查情况的报告称。“这并非单一的孤立漏洞或简单的网络钓鱼事件。攻击者结合了一系列技术，包括通过虚假招聘面试进行的社会工程学攻击、恶意软件下载、受损的内部人工智能工具、端点入侵以及一种先进的交易授权方法。”

Binance said that the first incident related to the compromise likely occurred in June, when an engineer downloaded a tampered version of Homebrew. The company linked to this incident reported in May, and its security team detected the compromised laptop, but only after the malware operators obtained information about the roles of the engineer and his related colleagues on the Binance wallet infrastructure team.

币安表示，与此次入侵相关的首起事件可能发生在 6 月，当时一名工程师下载了被篡改的 Homebrew 版本。该公司在 5 月份报告了与此相关的事件，其安全团队检测到了受损的笔记本电脑，但此时恶意软件操作者已经获取了该工程师及其在币安钱包基础设施团队相关同事的角色信息。

In September, a separate engineer received messages through a legitimate job-hunting platform he was using. The message came from an individual posing as a project director looking to hire new employees. The purported project director arranged a first-round interview with a supposed HR representative and a second-round interview with the purported CEO of the fictitious company.

9 月，另一名工程师通过他正在使用的合法求职平台收到了信息。信息来自一名冒充项目总监的人，声称正在招聘新员工。这位所谓的项目总监安排了与一名假想人力资源代表的第一轮面试，以及与这家虚构公司所谓首席执行官的第二轮面试。

During the first interview, conducted over a video platform, the purported HR representative shared a social media account that included personal photos and videos. The second interview took place over a social chat app. During it, the engineer was instructed to download an “assignment” that linked to a code repository containing malicious code that eventually executed on the engineer’s device during the setup process.

在通过视频平台进行的第一轮面试中，所谓的人力资源代表分享了一个包含个人照片和视频的社交媒体账户。第二轮面试通过社交聊天应用进行。期间，该工程师被要求下载一份“作业”，该作业链接到一个包含恶意代码的代码库，这些代码最终在设置过程中于工程师的设备上执行。

“The malware employed sophisticated obfuscation and evasion techniques, including replacing a legitimate development tool component with a malicious version to execute commands and establish communication with an attacker-controlled external server,” Binance said. “The 0-day malware was not detected by the endpoint security protection tools at the time. The attacker also took steps to conceal the malicious activity and remove traces of the compromise, making detection and subsequent investigation more challenging.”

“该恶意软件采用了复杂的混淆和规避技术，包括用恶意版本替换合法的开发工具组件，以执行命令并与攻击者控制的外部服务器建立通信，”币安表示。“当时，端点安全防护工具并未检测到该零日漏洞恶意软件。攻击者还采取了措施来掩盖恶意活动并清除入侵痕迹，这使得检测和后续调查变得更加困难。”

On October 20, the attackers used the compromised engineer’s computer and an internal AI tool to take control of two other engineer devices, including the one previously targeted with the trojanized Homebrew installer. That engineer’s wallet contained a token granting access to a container deployment. Nine days later, between 17:15 and 19:56 UTC, the threat actor logged in to the third engineer’s device, used the stolen credential, deployed a container, and activated a script to initiate the transfer.

10 月 20 日，攻击者利用被入侵的工程师电脑和内部人工智能工具，控制了另外两名工程师的设备，其中包括之前被植入木马版 Homebrew 安装程序的设备。该工程师的钱包中包含一个授予容器部署访问权限的令牌。九天后，在协调世界时（UTC）17:15 至 19:56 之间，威胁行为者登录了第三名工程师的设备，使用了窃取的凭据，部署了一个容器，并激活了一个脚本来启动转账。

Among other things, the attackers extended their unauthorized access to an internal wallet signing service to complete transactions outside the normal withdrawal process. Binance continued: Binance hot wallets on Solana and Optimism sent approximately 970,500 SOL and 44.2 million OP to attacker-controlled addresses. Binance then received an internal alert regarding large-volume transfers and immediately began investigating.

除其他事项外，攻击者将其未经授权的访问权限扩展到了内部钱包签名服务，以在正常提现流程之外完成交易。币安继续表示：币安在 Solana 和 Optimism 上的热钱包向攻击者控制的地址发送了约 970,500 枚 SOL 和 4420 万枚 OP。随后，币安收到了关于大额转账的内部警报，并立即展开调查。

Binance hot wallet sent 18,270 BTC to an attacker-controlled address. The attacker then used the signing service to exploit Ethereum’s EIP-7702 authorization mechanism. EIP-7702 allows an account to delegate certain execution rights to a smart contract without exposing the private key. In this case, the attacker used that mechanism to give an attacker-controlled smart contract partial execution rights over a Binance hot wallet.

币安热钱包向攻击者控制的地址发送了 18,270 枚 BTC。随后，攻击者利用签名服务利用了以太坊的 EIP-7702 授权机制。EIP-7702 允许账户在不暴露私钥的情况下将某些执行权限委托给智能合约。在此案例中，攻击者利用该机制赋予了受其控制的智能合约对币安热钱包的部分执行权限。

Binance immediately initiated multiple containment measures, including suspending withdrawals to restrict further outflows, coordinating with partners to freeze affected tokens, and taking steps to revoke unauthorized permissions. These efforts froze a total of $2.85 billion in assets. However, suspending withdrawals alone could not stop all unauthorized asset movements.

币安立即启动了多项遏制措施，包括暂停提现以限制进一步的资金流出，与合作伙伴协调冻结受影响的代币，并采取措施撤销未经授权的权限。这些努力总共冻结了 28.5 亿美元的资产。然而，仅靠暂停提现并不能阻止所有未经授权的资产转移。

The malicious EIP-7702 authorizations existed on-chain and operated independently of Binance’s normal withdrawal infrastructure. The attackers submitted 50 signing transactions to manipulate the account nonce and establish malicious delegation authorizations. Once established, these authorizations enabled the attackers to continue moving assets independently of Binance’s normal withdrawal infrastructure.

恶意的 EIP-7702 授权存在于链上，且独立于币安的正常提现基础设施运行。攻击者提交了 50 笔签名交易来操纵账户随机数（nonce）并建立恶意委托授权。一旦建立，这些授权使攻击者能够独立于币安的正常提现基础设施继续转移资产。

Binance needed additional transactions to revoke these on-chain authorizations. The containment process involved additional technical complexities. Because the hot wallet used Multi-Party Computation (MPC), there was no single private key that could be used to immediately revoke the malicious EIP-7702 authorizations. The team therefore developed and executed a specialized procedure to revoke these authorizations, which required additional time. Furthermore, suspending withdrawals and shut

币安需要额外的交易来撤销这些链上授权。遏制过程涉及额外的技术复杂性。由于热钱包使用了多方计算（MPC），因此没有单一的私钥可以用来立即撤销恶意的 EIP-7702 授权。因此，团队开发并执行了一套专门的程序来撤销这些授权，这需要额外的时间。此外，暂停提现和关闭……