On October 29, Binance lost control of about $6.34 billion in digital assets in a matter of hours. The attackers did not break in on that day, though. They had been working their way inside since June. The Binance hack was a slow campaign aimed at a handful of engineers, and it used a tampered download, a fake job interview and the exchange's own internal AI tool to reach the systems that sign transactions.
Binance CEO Richard Teng called it "one of the most sophisticated attacks the digital asset industry has ever seen." He said the company takes full responsibility and that no user will bear the loss.
Why the Binance Hack Targeted Engineers, Not Systems
According to the post-mortem Binance released on Tuesday, the attackers went after people with access to wallet infrastructure.
In June, Wallet DevOps Engineer A searched for a popular AI coding tool and downloaded a tampered Homebrew installation. Binance's security team spotted the anomaly, replaced the device and rotated his credentials. But the damage was done in another way: Engineer A's role, and his colleagues on the wallet infrastructure team, were now known to the attacker.
In September, the attackers moved to social engineering. Software Engineer B, whose profile on a legitimate job-hunting platform mentioned his Binance experience, was approached by someone posing as a project director. A first-round video interview followed with a supposed HR representative, who shared personal photos and videos on social media to build trust. Binance said this was more advanced than social engineering it had seen before.
In the second round, held on a popular chat app, Engineer B was told to download an "assignment" onto his work computer. It contained malicious code that ran during setup, swapped a legitimate development tool for a malicious version, and connected to an attacker-controlled server. The zero-day malware was not detected by endpoint security tools at the time.
On October 20, the attackers used Engineer B's compromised computer and an internal AI tool to gain control over Engineer A and another wallet engineer, Engineer C. They then found that Engineer A had a container deployment permission token on his machine.
How the Binance Hack Unfolded on October 29
Between 17:15 and 19:56 UTC, the attacker logged onto Engineer C's computer, used Engineer A's stolen credentials, deployed a container and triggered a malicious script. That gave them unauthorized access to an internal wallet signing service, which they used to send transactions outside the normal withdrawal process.
Between 20:05 and 20:09 UTC, five Binance hot wallets sent 233.46 million XRP to an attacker-controlled address. Hot wallets on Solana and Optimism sent about 970,500 SOL and 44.2 million OP. Binance then received an internal alert about large transfers, and another hot wallet sent 18,270 BTC.
Why Binance Couldn't Stop It Faster
Binance suspended withdrawals, but that did not end the outflows. The attacker had used the signing service to exploit Ethereum's EIP-7702 authorization mechanism. By submitting 50 signing transactions, they gave an attacker-controlled smart contract partial execution rights over a Binance hot wallet.
Those authorizations lived on-chain and worked independently of Binance's withdrawal systems. And because the wallet used Multi-Party Computation, there was no single private key that could instantly revoke them. Binance had to build a special procedure to do it. The final unauthorized transfer of 2,961.9 ETH was confirmed at 23:56 UTC. At 00:10 UTC on October 30, Binance cleared the malicious delegation.
Who Is Behind It
Over the weekend, the FBI and other U.S. agencies blamed the theft on TraderTraitor, a North Korea state-sponsored group that has spent years attacking cryptocurrency platforms. Binance said it had detected and stopped 57 suspected North Korea-linked threats in 2026 alone, many using fake job interviews and malicious developer tools.
On Tuesday, Kim Yo-jong rejected the U.S. findings, calling them a "grave political provocation" in a statement carried by the Korean Central News Agency. Observers noted the statement ended by saying Pyongyang had matters to "reconsider," without directly threatening retaliation.
South Korea's Unification Ministry called her personal response unprecedented. An official said it suggested the North was taking the allegations seriously and was "increasingly conscious of its international standing."
Where Users Stand
Binance says it has set aside more than 100% of the funds needed to cover the loss. As of October 31, 98% of impacted token assets had been replenished, and Binance is buying the remaining, less liquid assets. About $2.85 billion has been frozen or intercepted with help from law enforcement, token issuers and blockchain intelligence firms. Withdrawals have broadly resumed.
The exchange says it has rebuilt the affected wallet system and AI tool, replaced devices, revoked credentials tied to the affected engineers and brought in independent security firms.
The investigation is ongoing.
The FBI attributed the $6.3 billion Binance crypto heist to North Korean state hackers, sparking denials from Pyongyang amid ongoing asset recovery efforts.
The FBI blames North Korea for stealing $6 billion from Binance and urges crypto firms to block transactions linked to the stolen funds.
The FBI has named North Korea as the party behind the theft of more than $6 billion in virtual assets from the crypto exchange Binance, on or about October 29, 2026. The bureau published its findings in a public alert. The FBI specifically blames the North Korea-linked APT “TraderTraitor,” also tracked as Lazarus Group and APT38.
Binance hasn’t named a culprit, but the blockchain analysis firm TRM has. It was the first to attribute the attack to TraderTraitor, and Chainalysis also said it’s highly confident in that finding.
“The Federal Bureau of Investigation (FBI) is releasing information advising the Democratic People’s Republic of Korea (North Korea) was responsible for the theft of more than $6 billion USD in virtual assets from cryptocurrency exchange Binance, on or about October 29, 2026. The FBI refers to this specific North Korean malicious cyber activity as “TraderTraitor.”” reads the FBI’s statement.
“The FBI, together with partners at the USSS and IRS-CI, has observed TraderTraitor actors converting stolen assets primarily into Ethereum (ETH). It is expected these assets will then be further laundered by converting them using DeFi and instant swap services as they prepare them for further laundering stages.”
Attackers used access from an engineer’s laptop to reach a service container and send unauthorized withdrawal requests. Binance says it has found no evidence that attackers stole any wallet private keys.
The FBI, along with the U.S. Secret Service (USSS) and IRS Criminal Investigation (IRS-CI), has spotted TraderTraitor actors turning the stolen assets mostly into Ethereum (ETH). The agencies expect the next step to be more laundering, by swapping the funds through DeFi and instant swap services as the actors prepare them for later stages. Instant swap services are aptly named.
The alert is aimed at private companies as well as law enforcement agencies. The FBI, USSS and IRS-CI are asking several types of businesses to help stop the money laundering. These include THORNode operators, who support the THORChain network, RPC node operators, who provide apps with access to blockchains, instant crypto exchanges, DeFi platforms, blockchain analytics companies and other crypto service providers.
The request is clear: these companies should block any transactions involving the wallet addresses used by TraderTraitor, including funds that can be traced back to them. According to the FBI, these addresses have received stolen funds and are controlled by North Korean attackers or are closely linked to them. The full list of addresses is included in the alert.
If you run any of these services, the first job is to check your blocklists against that list. The second is to look at transaction flows that touch those addresses indirectly, since the FBI says to block anything “derived from” them, not just direct transfers. Blockchain analytics firms are named for a reason, because tracing derived funds is their work.
The FBI says it’s committed to protecting the virtual asset community by identifying, mitigating and disrupting North Korea’s illicit cybercrime and virtual asset theft.
“The FBI maintains its commitment to protecting the virtual asset community by identifying, mitigating, and disrupting North Korea’s illicit cybercrime and virtual asset theft activities.” concludes the report. “If you have any information to provide, please contact your local FBI field office or FBI’s Internet Crime Complaint Center at ic3.gov.”
TRM says the attacker moved about $6.36 billion out of Binance wallets on ten blockchains on October 29, most of it in roughly 20 minutes starting at 20:05 UTC. That makes it the largest crypto theft on record, about four times the $1.5 billion Bybit hack of February 2025.
“On October 29, 2026, an attacker moved approximately USD 6.36 billion out of Binance wallets on ten blockchains, most of it in about 20 minutes starting at 20:05 UTC. That makes this the largest crypto theft on record, about four times the USD 1.5 billion Bybit hack of February 2025. Binance has confirmed a security incident and suspended withdrawals on several networks.” TRM said. “TRM attributes the attack to TraderTraitor, North Korea’s elite hacking unit, based on robust on and off-chain intelligence. We make this judgment with high confidence. TRM is tracking the funds and alerting partners through the Beacon Network.”
Freezing the money only went partway. Tether, Circle, Ripple and World Liberty Financial froze about $2.67 billion in stablecoins, and Arbitrum’s Security Council froze 8,426 ETH and 74.6 million ARB, for roughly $2.7 billion in all. But the attacker raced the freezes by selling USDT to market makers and borrowing ETH against USDT on Aave. It now holds more than 420,000 ETH and 18,270 BTC, about $2.4 billion beyond any issuer’s reach.
The early freeze numbers were messy too, Tether and Circle froze approximately $1.79 billion in stablecoins associated with the suspicious transfers in the initial reports. Those amounts describe different moments, and you shouldn’t add them without checking whether they cover distinct assets. A freeze works on tokens that have an issuer to call, and Ether and Bitcoin don’t.
Below is the link to my interview regarding the Binance case for Italian state television.
FBI links 628 crypto wallet addresses to North Korea’s TraderTraitor after the $6.3 billion Binance hack, asking services to block transfers involving stolen funds.
Binance links a $6.3 billion crypto theft to a compromised DevOps laptop, with North Korean hackers blamed by blockchain analysts.
Binance was investigating suspicious transfers that early estimates put at up to $5.8 billion. A day later, multiple media outlets reported that the largest cryptocurrency exchange had linked the theft of about $6.3 billion to a DevOps engineer’s compromised laptop. Billions had moved out of wallets linked to the exchange.
According to The Block, blockchain analyst Spreek identified approximately $3.55 billion in incoming transfers to an initially unidentified wallet.
“Onchain data flagged by analyst Spreek shows about $3.55 billion in incoming transfers to the unlabeled wallet, with nearly $900 million subsequently moved across other wallets.” The Block reports. “Conor Grogan, a senior director and product leader at Coinbase, says the amount is up to $5.8 billion.”
Coinbase executive Conor Grogan initially estimated that the total value of the movements could reach $5.8 billion.
Those figures came from blockchain tracking and differing estimates, so they didn’t necessarily show the amount stolen.
Binance pointed out that customer funds were safe, while co-founder Changpeng Zhao, widely known as CZ, said the activity appeared to be a hack. Zhao no longer manages Binance’s platform, but said he expected customers’ funds to be fully covered.
The company said its user funds were “completely safe.”
“Our teams are aware of reports of a potential security issue and are actively investigating. User funds are completely safe. Our security teams are reviewing all relevant information with urgency, and we will provide updates through official Binance channels as soon as we have verified information.” the company states. “Users should remain cautious of scams and should not trust unofficial links, messages, or requests for account information.”
That assurance is important, but it doesn’t replace a technical explanation of how the transfers occurred or independent confirmation of the final impact.
“Our initial investigation suggests this security incident may have started with a compromised DevOps engineer’s laptop. That gave an attacker access to a service container, where they submitted unauthorized withdrawal transactions.” Binance Co-CEO Richard Teng explained.
“To be clear: the attacker did not simply use one engineer’s permissions, and this was not a single “one-click” action. It involved a more complex attack process. Our investigation has not attributed responsibility to any individual.”
I want to speak to you directly about what happened.
Bottom line – your money is safe, and we're covering every loss.
Our initial investigation suggests this security incident may have started with a compromised DevOps engineer's laptop. That gave an attacker access to a…
Attackers used access from an engineer’s laptop to reach a service container and send unauthorized withdrawal requests. Binance says it has found no evidence that attackers stole any wallet private keys.
Binance also said it had found “additional points of breach” and was still investigating. Co-CEO Richard Teng said the investigation had not identified anyone responsible. After the attack, Binance suspended deposits and withdrawals to carry out security checks, cancelled the permissions linked to the affected address, and began working with blockchain analysis firms and law enforcement to track the stolen funds.
Binance says it will cover all losses using its SAFU fund and its own money, and that customer funds are safe. The company also plans to publish an updated Proof of Reserves once it has completed the recovery work. This commitment does not replace a detailed technical explanation or independent confirmation of the full impact of the attack.
Binance hasn’t named a culprit, but the blockchain analysis firm TRM has. It attributes the attack to TraderTraitor, a North Korean state-backed unit also tracked as Lazarus Group and APT38, and Chainalysis says it’s highly confident in that finding.
Our investigators observed funds stolen by DPRK in last month's Bitget exploit commingling with funds stolen from Binance.
We have a high degree of confidence that DPRK is responsible for the $6.4 billion hack of Binance. https://t.co/xj9dQYcbKr
TRM says the attacker moved about $6.36 billion out of Binance wallets on ten blockchains on October 29, most of it in roughly 20 minutes starting at 20:05 UTC. That makes it the largest crypto theft on record, about four times the $1.5 billion Bybit hack of February 2025.
“On October 29, 2026, an attacker moved approximately USD 6.36 billion out of Binance wallets on ten blockchains, most of it in about 20 minutes starting at 20:05 UTC. That makes this the largest crypto theft on record, about four times the USD 1.5 billion Bybit hack of February 2025. Binance has confirmed a security incident and suspended withdrawals on several networks.” TRM said. “TRM attributes the attack to TraderTraitor, North Korea’s elite hacking unit, based on robust on and off-chain intelligence. We make this judgment with high confidence. TRM is tracking the funds and alerting partners through the Beacon Network.”
Freezing the money only went partway. Tether, Circle, Ripple and World Liberty Financial froze about $2.67 billion in stablecoins, and Arbitrum’s Security Council froze 8,426 ETH and 74.6 million ARB, for roughly $2.7 billion in all. But the attacker raced the freezes by selling USDT to market makers and borrowing ETH against USDT on Aave. It now holds more than 420,000 ETH and 18,270 BTC, about $2.4 billion beyond any issuer’s reach.
The early freeze numbers were messy too, Tether and Circle froze approximately $1.79 billion in stablecoins associated with the suspicious transfers in the initial reports. Those amounts describe different moments, and you shouldn’t add them without checking whether they cover distinct assets. A freeze works on tokens that have an issuer to call, and Ether and Bitcoin don’t.
Hot wallets help explain how this type of theft can happen. They store cryptocurrency in systems connected to the internet, allowing exchanges to process withdrawals quickly. But this also makes strong security controls essential. Investigators still need to determine who initiated the transfers, whether they were authorized, whether attackers gained control of the wallets, and whose funds were stolen.
Binance co-founder Changpeng Zhao, who no longer runs the company, said the activity looked like a hack and expected customers to be fully compensated. Large transfers alone do not prove a cyberattack, but the findings that emerged later provided strong evidence of a breach.
Customers also need to be careful. Attackers often exploit the confusion after a major incident by spreading fake announcements, pretending to be support staff, and directing users to fraudulent websites. Use only Binance’s official channels, avoid unexpected links, and never share passwords, authentication codes, or wallet recovery phrases in response to unsolicited messages. Security teams should also watch for phishing emails that use the incident to pressure employees into verifying their accounts.
The lesson goes beyond Binance. A public blockchain records every transaction, but it cannot show who authorized it or how attackers gained access. Blockchain transparency does not guarantee operational security.
Binance probes a DevOps engineer’s hacked laptop after a $6.3 billion theft linked by researchers to North Korean hackers, and promises to cover all customer losses.
Purpose and Scope APT cases disclosed in September 2026 demonstrate that attacks have evolved to exploit the developer ecosystem, cloud services, and network management infrastructure as trust layers. Legitimate software installers, GitHub repositories, Microsoft 365, OneDrive, Telegram, Nostr, routers, and authentication servers were all included in the attack chain. Key Trends Supply chain attacks have […]
Entrar
In the second round, held on a popular chat app, Engineer B was told to download an "assignment" onto his work computer. It contained malicious code that ran during setup, swapped a legitimate development tool for a malicious version, and connected to an attacker-controlled server. The zero-day malware was not detected by endpoint security tools at the time.
On October 20, the attackers used Engineer B's compromised computer and an internal AI tool to gain control over Engineer A and another wallet engineer, Engineer C. They then found that Engineer A had a container deployment permission token on his machine.
