US — Ars Technica

Binance says hackers who stole billions in crypto spent months planning heist

SecurityNovember 5, 20261 min read

Crypto exchange Binance says hackers spent months planning a theft that targeted $6.34 billion in digital money. The FBI and a security firm blame North Korean hackers.

What happened

Binance said the hackers spent months on the theft. They used tricks that fool people, plus new kinds of harmful software. The attack first targeted $6.34 billion in crypto held in Binance wallets. Binance has frozen or stopped $2.85 billion of it so far. The company says it has set aside money to cover the rest of the loss.

Key numbers

$6.34 billion: the amount first targeted, the biggest sum ever targeted in a crypto theft
$2.85 billion: the part Binance has frozen or intercepted
June: the earliest the attack likely started, when an engineer downloaded a tampered version of Homebrew
Last Thursday: the day the hackers broke into an engineer's laptop and moved assets out of several wallets

How the attack worked

Binance says this was not a simple attack. The hackers used fake job interviews to trick people. They also used harmful downloads and broke into a company computer. Binance called it a multi-stage plan, meaning many steps over time. The hackers got details about which engineers worked on Binance's wallet systems, and that helped them.

Why it matters

This shows that even big, well-known crypto companies can be attacked in careful, slow ways. Stolen crypto is hard to get back. The case also shows how some groups may use hacking to raise money, according to the FBI and TRM Security.

What to watch

How much of the $6.34 billion Binance can freeze or get back
Whether Binance's Proof of Reserves page shows the funds set aside to cover losses
Final findings from the FBI and TRM Security on who was behind the attack
Any changes Binance makes to protect engineers and wallet systems

Glossary

Binance: A large crypto exchange, a website where people buy, sell and hold digital money.
Homebrew: A free tool that installs extra software on Apple computers; here, a fake copy was used to spread malware.
Proof of Reserves: A public check that shows a crypto company holds the money it says it holds.
TRM Security: A firm that tracks crypto crime and helps investigate thefts.

Muji's MUJI Card Full Card Numbers, About 1.09 Million Records Possibly Leaked in Unauthorized Access Follow-Up

Ryohin Keikaku said credit card information, names, and addresses that it had initially excluded may also have been accessed by outsiders in the unauthorized access to its MUJI app. Newly identified data includes about 1.09 million member records for the MUJI Card, covering full card numbers, MUJI Card IDs, and birth dates, of which about 345,000 cards remain valid.

Security전자신문Nov 4

Tilon's Dstation X Obtains NIS Security Function Verification Certificate, Clearing Public-Sector Adoption Requirements

VDI company Tilon said its next-generation platform Dstation X (v10.0) has received a security function verification certificate from the National Intelligence Service under its security function testing system. With this, Dstation X has completed quality certification, a procurement channel on the Digital Service Mall, and security verification required for public-sector adoption. Agencies adopting the product can skip the separate security conformity verification process.

SecurityITmediaNov 4

Chinese Manufacturer Allegedly Installed Criminal Backdoor on Android Devices Before Shipment; Google Cuts Ties

Google said on November 3 (local time) that more than 1.3 million devices, mainly Android TV set-top boxes, were infected with malware made by Chinese OEM/ODM maker Videostrong Technology, which sold remote access to criminals. Google ended its relationship with the company, barred it from making Google-certified Android devices and supplying software to other certified makers, and disrupted the botnet with law enforcement and security partners, including Japan's National Police Agency.