Binance said hackers stole $6.34 billion from its wallets on October 29 in about 20 minutes, an attack the company described as the result of a fake job interview and a malicious software download rather than a single isolated breach. In a security update issued Tuesday, the exchange said it has set aside funds to cover the losses and has rebuilt or replaced internal systems affected in the attack, according to a company report.
The FBI attributed the theft to North Korea-linked hackers known as TraderTraitor on October 31, the same actors linked to a $1.5 billion Bybit hack last year, according to the bureau. Binance said it had enough set aside in the same digital currency that was stolen to cover 90% of the missing assets and promised that customers would be fully reimbursed [1].
Binance said its chief executive issued a public apology, stating the company would absorb the financial impact on users.
How the Attack Unfolded, According to Binance
Binance said activity linked to the hack could be traced to June, when an engineer identified as Engineer A downloaded a tampered Homebrew installation found through a web search. Binance said its security tools did not detect the malware, and while the company replaced the compromised engineer's laptop, the hackers used the engineer's stolen credentials to break into the computer of a third engineer [2].
In September, Binance said Engineer B was contacted on a legitimate job-hunting platform and attended a video interview with a fake recruiter who provided legitimate-looking social media accounts and personal photos to appear authentic. Binance said Engineer B progressed to a second-round chat interview and was instructed to download an assignment containing a malicious code repository onto a work computer.
The report stated the malware replaced a legitimate development tool component with a malicious version in order to execute commands and communicate with an attacker-controlled server. Binance said attackers used access to engineer machines to gain control over wallets associated with Engineers A and C, then logged into Software Engineer C's computer with stolen credentials.
On October 29, Binance said the attacker exploited unauthorized access to an internal wallet signing service to initiate transactions outside normal withdrawal procedures across more than 10 blockchains. The company said the incident was not a single isolated breach or a simple phishing incident.
Attribution and Industry Response
Multiple cryptocurrency tracing firms attributed the attack to the Democratic People's Republic of Korea's hackers, particularly the TraderTraitor group, according to Binance's update. Two major blockchain analytics firms said they identified the North Korean state-backed group with high confidence, according to the BBC [3].
Binance stopped short of directly blaming TraderTraitor but cited the FBI's attribution and said its security team detected and prevented 57 suspected North Korea-linked cyber threat cases throughout 2026.
Pilling said the attackers did not simply steal a wallet key but compromised engineers, used that access to move through the environment and subvert transaction authorization systems. "The initial compromise is just a foothold," Pilling said. "The real attack is carefully engineered around how the victim actually moves money."
Frozen Funds and Laundering Efforts
Binance said more than $6 billion was stolen, but almost half was frozen where possible by parts of the cryptocurrency industry. The company said the remaining funds are controlled by North Korea-linked hackers, who are trying to launder the stolen cryptocurrency into accessible forms. Binance said the remaining 10% of stolen assets may take longer to source in the required amounts [4][5].
Elliptic cofounder and chief scientist Tom Robinson wrote in a blog post that the laundering from the Binance attack has been highly complex and likely automated. Robinson said the operation used about 12,000 wallets across 11 blockchains in its first three and a half days, with roughly one new wallet every 25 seconds and more than 40,000 transactions.
TRM Labs analysis cited in the report said North Korean-linked hackers have stolen around $12 billion in cryptocurrency since 2017, with more than half coming from heists this year. Binance said it has covered the vast majority of the stolen assets and pledged to make users whole [4].
What Remains Unclear
Binance described its findings as initial and said its investigation is continuing. It is unclear how much of the stolen money ultimately reaches North Korea, because some funds can be frozen or blocked by exchanges, and tracing firms have noted that not all stolen assets can always be recovered.
A report from the Multilateral Sanctions Monitoring Team, which includes experts from the United States, South Korea and nine other countries, said laundered funds could support North Korea's nuclear weapons and ballistic missile programs.
For individual holders, the episode has renewed scrutiny of the tradeoffs between the self-custody of decentralized money and the convenience of centralized exchanges. Hardware wallets and multi-signature setups are harder to attack remotely than exchange hot wallets, and privacy-focused, self-custodial tools remain an alternative for users seeking to reduce exposure to a single point of failure [6].
Conclusion
The Binance breach underscores that the most durable threats to digital asset platforms are well-known human and system weaknesses rather than exotic exploits.
Binance said the funds have been substantially replenished and that users will not bear the loss. Analysts have said the attack could prompt investors to reassess their assumptions about the security of custodial exchanges. The company said it is continuing to cooperate with authorities and blockchain analytics firms as the investigation proceeds [4][1].
References
- FBI Blames North Korea for Stolen Billions From Binance in Biggest Hack in History. https://www.ntd.com/fbi-blames-north-korea-for-stolen-billions-from-binance-in-biggest-hack-in-history_1182687.html
- Researchers warned of North Korean hacking tactics years before record $6.3B Binance heist. https://techcrunch.com/2026/11/03/researchers-warned-of-north-korean-hacking-tactics-years-before-record-6-3b-binance-heist/
- Why North Korea's 'elite' hackers are the prime suspect in major Binance hack. https://bbc.com/news/articles/ck9dz3v7z7v3o
- Crypto firm Binance covers 90% of losses after $6.3bn hack. https://bbc.com/news/articles/ckpdg3ql4169o
- Binance Says It Has Covered $6 Billion of $6.3 Billion Stolen in Hack. https://money.usnews.com/investing/news/articles/2026-10-31/binance-says-90-of-stolen-assets-replenished
- Blockchain Startups: Bitcoin and Ethereum as the Frontier of Finance. By Stefan King
Explainer Infographic
Please contact us for more information.