Crypto exchange Binance says state-backed North Korean hackers executed the largest theft in financial history, siphoning $6.3 billion from the platform through a monthslong campaign built on fake job interviews, rigged software and stolen employee credentials.
Binance published a report Tuesday tying the attack to TraderTraitor, a North Korean cybercrime group known for moving stolen crypto quickly through international networks to evade recovery. North Korea has denied involvement, with state-backed media describing the accusation as a “grave political provocation.”
A Slow Infiltration
The operation began in June 2026, when a Binance employee identified only as “Engineer A” downloaded what he believed was a popular AI coding tool, pushed through fake advertisements. The software was tampered with malware. Binance’s security team detected the intrusion, replaced the employee’s device and reset credentials company-wide. But the damage was already partly done: the hackers had gathered intelligence on Engineer A and his colleagues’ roles inside the company.
The scheme resumed in September, targeting a second employee, “Engineer B,” through a legitimate job-search platform. A person posing as a project director initiated contact, and Engineer B advanced through a first-round interview with a fake HR representative who used photos and videos lifted from a real social media account to appear credible. In a second round, someone posing as a company CEO asked him to download a work “assignment” onto his company computer. That file contained malicious code.
On October 20, the attackers used Engineer B’s now-compromised machine, combined with an internal Binance AI tool, to seize control of Engineer A and a third employee, “Engineer C.” That access revealed Engineer A still had a deployment permission token sitting on his device — a powerful credential the hackers would soon exploit.
Twenty Minutes, Billions Gone
On October 29, the hackers used that stolen token to launch the attack, draining billions of dollars from crypto wallets in just 20 minutes and scattering the funds across global networks. Binance detected the breach that same Thursday evening and moved to contain it, working with other exchanges and stablecoin providers to freeze roughly $2.8 billion of the stolen funds. Around $3 billion was lost outright.
Binance suspended withdrawals and pledged to cover all customer losses in full. As of Saturday, the company said it had replenished 98 percent of the affected tokens and was working to source the rest, noting in a statement that the remaining funds “are less liquid in the market and take longer to source at the required scale.”
To make customers whole, Binance committed more than $6 billion of its own funds, including half of its $1 billion Secure Asset Fund for Users along with corporate treasury money. The company says it intends to rebuild that fund back to roughly $1 billion. Despite the breach, Binance reports $157 billion in current total assets, and it absorbed $4.7 billion in customer withdrawals in the aftermath alongside broader market volatility.
Binance’s Response
Co-CEO Richard Teng’s company acknowledged the scale of the failure in its Tuesday statement.
“This should not have happened, and we apologize for the concern, disruption and uncertainty it caused our users, partners and the wider industry.”
Binance also outlined the steps taken since the breach.
“We have taken immediate action to contain the incident and strengthen the systems involved. The identified entry points used in the attack have been closed, systems touched in the attack path have been rebuilt or replaced, and we have implemented tighter device controls, enhanced wallet-service risk controls and expanded AI anomaly detection.”
For a sector that prides itself on decentralization and resistance to institutional failure, the episode is a reminder that human trust — a convincing fake resume, a fabricated interview, a plausible download link — remains the weakest link even in systems built to be tamper-proof.
Add comment