Binance says months-long North Korea-linked campaign led to $6.3B hack

Binance says a months-long campaign by North Korea-linked attackers led to about $6.3 billion in stolen crypto, after the hackers compromised employees and gained control of wallet signing operations. The exchange’s 3 November account says the intruders used fake recruitment interviews, malicious software and an internal AI tool; the FBI attributed the theft to North Korea’s TraderTraitor activity.

Binance’s initial incident report describes a sequence of compromises stretching from June to the theft on 29 October. That timeline matters because the loss did not begin with a single suspicious withdrawal: attackers used access to employee devices and systems to reach the infrastructure that authorized transactions from a hot wallet, a crypto wallet connected to online services.

How did a fake interview lead to the breach?

Binance says the attackers used two employee compromises to get closer to its wallet systems. The first reported foothold came in June, when a Wallet DevOps engineer downloaded a tampered Homebrew installation while looking for an AI coding tool. Binance says it detected the anomaly, replaced the device and rotated related credentials, but the attackers had learned about the engineer’s role and colleagues on the wallet team.

In September, a second engineer was approached on a legitimate job platform by someone posing as a project director. A first interview included a video call with a purported HR representative; a later interview ended with the engineer being asked to download a coding assignment to a work computer. Binance says the repository contained malware that evaded endpoint security and enabled contact with an attacker-controlled server.

According to Binance, the attackers then used the compromised machine and an internal AI tool on 20 October to reach two other wallet engineers’ computers. On 29 October, they used stolen credentials to deploy a container and run a malicious script. The attack unfolded in these stages:

1. Use social engineering and tampered software to compromise employee devices.
2. Move through internal systems using access tied to wallet engineers.
3. Reach the signing service and authorize unauthorized hot-wallet transfers.

How did the attackers move the funds?

The FBI’s public alert says North Korea was responsible for stealing more than $6 billion from Binance on or about 29 October, and identifies the activity as TraderTraitor. Binance says the attackers used Ethereum’s EIP-7702 authorization mechanism to give an attacker-controlled smart contract execution rights over a hot wallet. That mechanism delegates certain actions without revealing the wallet’s private key.

Binance says the method let unauthorized transfers continue outside its usual withdrawal system, even after it suspended withdrawals. The exchange reports that the final unauthorized transfer settled at 23:56 UTC on 29 October, and that it cleared the malicious delegation code at 00:10 UTC on 30 October. It says its response froze $2.85 billion in assets.

What does Binance say happens to user funds now?

Binance says it will absorb the financial impact rather than pass the loss to users. Its report says that, as of 31 October, it had replenished 98% of the affected token assets and set aside more than the amount needed to cover the loss; it was still purchasing the remaining, less liquid assets as of the 3 November report. Those are the exchange’s stated figures, not an independent audit of the replenishment.

For you as a customer, the immediate issue is the exchange’s ability to contain an attack that reached wallet signing operations. Binance says it rebuilt affected wallet systems and its internal AI tool, replaced devices, revoked credentials and tokens, and is bringing in independent cybersecurity experts to review the incident. It also says it detected and prevented 57 suspected North Korea-linked cyber threat cases during 2026. The review’s findings should clarify what safeguards change after attackers gained access through employee systems and used it to move assets.

Sources and documents

• initial incident report — binance.com
• public alert — fbi.gov