ع
Binance released an initial incident report on November 3 detailing a sophisticated, multi-stage campaign that resulted in the theft of $6.3 billion from its hot wallets on October 29. The exchange attributed the breach to North Korean state-sponsored hackers, a finding echoed by the FBI which linked the operation to the TraderTraitor group associated with the Lazarus collective. Co-CEO Richard Teng described the attack as a months-long effort combining social engineering, malware and internal system exploits rather than an isolated failure. The company has since frozen or intercepted about $2.85 billion in assets and replenished 98 percent of the impacted tokens using its reserves.
The operation began in June 2026 when one software engineer downloaded a tampered version of a popular AI coding tool after clicking on a malicious online advertisement, according to Binance’s assessment. Although security teams detected the malware and replaced the affected device along with related credentials, the attackers learned key details about the engineer’s role and colleagues on the wallet management team. This information informed subsequent targeting, the report stated. Binance noted that it had already identified 57 suspected North Korea-linked cyber threats during 2026, many involving similar recruitment tactics.
In September a second engineer was approached through a legitimate job-hunting platform where his profile listed his Binance experience, the exchange reported. The individual posing as a project director arranged interviews, first with a purported HR representative who shared personal social media content including photos and videos to establish credibility. During a follow-up discussion framed as a meeting with the CEO of a fictitious company, the engineer was instructed to download what was presented as a coding assignment but contained hidden malware designed to evade detection. The malicious code used sophisticated obfuscation techniques and established communication with attacker-controlled servers.
Attackers leveraged the compromised September device together with an internal artificial intelligence tool on October 20 to gain control of additional wallet engineers’ systems, Binance’s chief security officer Jimmy Su explained in a media briefing. They obtained deployment permission tokens and stolen credentials that allowed deeper access to the wallet-signing infrastructure. The exchange said the malware replaced legitimate development components to execute remote commands undetected. This phase built directly on intelligence gathered from the earlier June compromise.
On October 29 the hackers deployed a malicious script using the stolen credentials, draining the equivalent of $6.3 billion in digital assets within approximately 20 minutes before dispersing the funds across global networks, according to the timeline in Binance’s report. The exchange has rebuilt affected systems and strengthened controls while commissioning an independent cybersecurity review to assess remaining vulnerabilities. Teng stated on X that the speed of coordination in responding to the incident could not be matched in traditional finance.
Similar social engineering campaigns linked to North Korean actors have targeted the crypto sector for years, with one operation known as Contagious Interview infecting more than 30,000 devices and affecting 7,000 wallets between December 2025 and July 2026, blockchain security researchers have documented. Binance has advised employees in non-public roles to avoid maintaining profiles on professional networking platforms. The exchange emphasised that it will cover the full financial impact and continues to work with law enforcement on asset recovery efforts.
