The hackers who stole billions of dollars in cryptocurrency from the Binance exchange spent months working on the theft and used both social engineering and novel malware in the process, the company said Tuesday.

The heist, which both the FBI and the TRM Security firm attributed to North Korean actors, initially targeted $6.34 billion in cryptocurrency from Binance wallets. The exchange has since frozen or intercepted $2.85 billion of that sum. Binance said it has set aside funds required to cover the loss and provided this link to a Proof of Reserves page. The $6.34 billion represents the biggest sum ever targeted in a cryptocurrency theft.

Advanced persistent threat

Binance said the people behind the heist began no later than June and continued until last Thursday, when they successfully compromised an engineer’s laptop and withdrew assets from several wallets. Like just about every organization that suffers a public, high-consequence hack, Binance said the threat actor was sophisticated and resourceful.

“Our current investigation indicates that this was a sophisticated, multi-stage campaign,” a report on the company’s investigation to date said. “It was not a single isolated breach or a simple phishing incident. The attackers combined a range of techniques, including social engineering by fake recruitment interviews, malicious software downloads, compromised internal AI tooling, endpoint compromise, and an advanced transaction-authorisation method.”

Binance said that the first incident related to the compromise likely occurred in June, when an engineer downloaded a tampered version of Homebrew. The company linked to this incident reported in May, and its security team detected the compromised laptop, but only after the malware operators obtained information about the roles of the engineer and his related colleagues on the Binance wallet infrastructure team.