巴黎/底特律，11月3日电：币安周二表示，黑客利用虚假招聘面试和隐藏在其中的软件，攻破了两名币安软件工程师的电脑，随后利用第三名工程师的电脑，在上周的这起创纪录盗窃案中窃取了价值63亿美元的加密货币。
PARIS/DETROIT, Nov 3 : Hackers used a bogus job interview and software hidden in an to compromise the computers of two Binance software engineers before using a third's computer to drain $6.3 billion worth of crypto in last week's record heist, the exchange said on Tuesday.
在关于黑客如何实施这起可能是有史以来最大金融盗窃案的初步报告中，币安详细披露了这起多阶段黑客攻击行动，该行动始于6月，并引发了一系列安全漏洞，最终导致周四发生盗窃。
In its initial report on how hackers pulled off what could be the largest-ever financial theft, Binance detailed a multi-stage hacking endeavour that began in June and set off a series of security breaches culminating in the theft on Thursday.
币安表示，即使在周四晚间发现攻击后，币安争分夺秒锁定系统并冻结提币，黑客在首次盗窃发生后近四小时内，仍在从交易所窃取加密货币。
Even as Binance scrambled to lock down its system and freeze withdrawals after detecting the attack late on Thursday, the hackers were still making off with crypto from the exchange nearly four hours after the first theft, Binance said.
美国联邦调查局（FBI）将此事归咎于一个朝鲜黑客组织，朝鲜方面予以否认。币安表示，正在偿还所有被盗资金的客户。
The FBI has blamed a North Korean hacking group, a claim North Korea has rejected. Binance has said it is repaying all customers whose funds were stolen.
这起攻击引发了关于黑客如何攻破全球最大加密货币交易所的质疑，此前已发生多年与朝鲜有关的攻击，且野心和频率与日俱增，同时也重新引发了关于数字资产易受网络犯罪侵害的担忧。
The attack has raised questions about how hackers breached the world's largest crypto exchange after years of North Korea-linked attacks, which have grown in ambition and frequency, and renewed questions about the vulnerability of digital assets to cybercrime.
网络安全专家和政府官员多年来一直警告，朝鲜及其他黑客利用虚假招聘面试，以感兴趣公司的员工为目标，网络安全公司DTEX的研究员迈克尔·巴恩哈特表示。虚假招聘面试是一种众所周知的黑客技术。
Cybersecurity experts and government officials have for years warned about North Korean and other hackers using phony job interviews to target employees at companies of interest, said Michael Barnhart, a researcher with cybersecurity firm DTEX. Fake job interviews are a well-known hacking technique.
币安表示，2026年已检测并阻止了57起疑似与朝鲜有关的网络威胁。巴恩哈特说，这表明币安“正遭受猛烈轰炸”。
Binance said it had detected and prevented 57 suspected North Korea-linked cyberthreats in 2026. That shows Binance is “just getting barraged,” Barnhart said.
币安在报告中表示：“这不应该发生，我们为给用户、合作伙伴和整个行业带来的担忧、干扰和不确定性道歉。”币安暴露安全漏洞币安表示，攻击始于6月，当时其钱包开发团队的一名员工从互联网下载了一个工具，该工具已被黑客篡改。该交易所称，事后检测到此事，更换了设备并修改了凭证，但该员工的角色以及钱包团队其他成员的角色已暴露。
"This should not have happened, and we apologise for the concern, disruption and uncertainty it caused our users, partners and the wider industry," Binance said in its report. LEFT EXPOSED Binance said the attack began in June when an employee on its wallet developer team downloaded a tool from the internet that hackers had tampered with. The exchange said it detected this afterwards, replaced the device and changed credentials, but the employee's role and those of others on the wallet team were exposed.
一位知情人士表示，该工具的恶意版本被放置在一个搜索引擎优化结果中，这意味着它在搜索引擎中的排名高于真实版本。
A person familiar with the incident said the tool's malicious version had been placed in an , which meant it appeared higher in a search engine than the real version.
随后在9月，一名正在寻找新工作的第二位软件工程师，在面试自以为是合法职位的过程中（包括与一家虚构公司的首席执行官进行视频会面）后，将一个“恶意代码仓库”下载到了个人电脑上，币安的报告称。
Then in September, a second software engineer seeking a new job downloaded a "malicious code repository" onto the person's computer after interviewing for what they thought was a legitimate role, including meeting virtually with the CEO of a fictitious company, Binance's report said.
10月20日，攻击者利用被攻破的电脑加上一个内部AI工具，控制了钱包开发人员的系统以及第二位钱包开发人员的系统。
On October 20, the attacker used the compromised computer plus an internal AI tool to gain control of the wallet developer's system and that of a second wallet developer.
九天后，攻击者利用第二位钱包开发人员的电脑，配合从第一位钱包开发人员处窃取的凭证，触发恶意脚本发动攻击。
Nine days later, the attacker used the second wallet developer's computer, with stolen credentials from the first wallet developer, and triggered a malicious script to launch the attack.
一位知情人士称，公司内只有少数工程师拥有直接访问钱包的权限——钱包用于存储或交易加密货币。加密货币几分钟内被转走币安在其报告中称，攻击于10月29日迅速展开，在短短四分钟内，从五个币安热钱包（即联网钱包）转移了2.3346亿枚XRP（一种加密货币）至攻击者控制的地址，随后攻击者又提取了包括比特币在内的其他加密货币。
A limited number of engineers at the company have direct access to wallets — which store or trade crypto — the person familiar with the hack said. CRYPTO REMOVED IN MINUTES The attack unfolded quickly on October 29, removing 233.46 million XRP — a cryptocurrency — from five Binance hot, or internet-connected, wallets to an attacker-controlled address in just four minutes, before attackers withdrew other cryptocurrencies including bitcoin, the exchange said in its report.
币安表示，收到关于大额转账的内部警报后开始调查。公司采取措施暂停提币、冻结受影响代币并移除未经授权的权限，导致约28.5亿美元资产被冻结，但仅暂停提币无法阻止所有未经授权的资产转移。
Binance said it received an internal alert about large transfers and began investigating. It moved to suspend withdrawals, freeze affected tokens and remove unauthorised permissions, resulting in about $2.85 billion of frozen assets, but suspending withdrawals alone could not stop all unauthorised asset movements.
攻击者利用 50 克拉（编者注：此处原文为 “50g”，推测为 “50 Gwei” 或类似单位，但按原文直译）交易操纵账户，而币安表示被迫建立新程序以撤销授权，导致响应变慢。
Attackers used 50g transactions to manipulate the account, while Binance said it was forced to build new procedures to revoke authorisations, slowing its response.
币安表示，最后一次未经授权的转账发生在格林威治时间 23:56，距离攻击开始已近四小时。
The final unauthorised transfer was at 2356 GMT, Binance said, nearly four hours after the attack began.
币安称，由于此次黑客攻击，正在增加对人工智能驱动检测的投资，并致力于设立安全研究基金，同时与领先的人工智能公司开展有针对性的合作举措。
Binance said as a result of the hack, it was increasing investment in AI-enabled detection and working on establishing a security research fund and targeted initiatives with leading AI companies.