On November 3, the world’s largest cryptocurrency exchange, Binance, disclosed that North Korean hackers successfully infiltrated their wallet infrastructure using deceptive recruitment interviews, malware, and breaches of internal AI tools. This attack culminated in a record-setting cyber assault on October 29, resulting in the theft of assets exceeding $6 billion from the platform.
In a security report released on Tuesday, Binance detailed the intricacies of the attack. CEO Richard Teng, during an interview with CNBC that same day, refuted earlier claims suggesting that the breach originated from an employee’s laptop. He stated that the attackers had spent several months gradually penetrating the system, emphasizing, “This was not a mistake or a violation. It was a meticulously planned operation lasting several months.”
The attackers devised a fraudulent developer tool, which was successfully lured an operational engineer from Binance to install. This engineer, referred to as A, downloaded a Homebrew installation package embedded with malicious code for the purpose of installing AI programming tools.
The report indicated that Binance’s security team detected unusual activity and, as a precautionary measure, replaced A’s computer and reset all related credentials. However, by that time, the hackers had already acquired information about A’s role and colleagues.
Taking disguise to a new level, the hackers impersonated recruiters from a fictitious company and contacted another Binance engineer, referred to as B, extending a job invitation. This impersonated project manager arranged two rounds of interviews: a video call with a claimed “HR” representative, followed by a second interview with an individual posing as the “CEO.”
During this process, the hacker ultimately requested Engineer B to download a programming test assignment. Upon doing so, B’s work computer was infected with zero-day malware that went undetected by existing security systems.
Using Engineer B’s compromised computer, the hackers accessed Binance’s internal AI tools and leveraged this foothold to further infiltrate the computers of Engineers A and C, ultimately stealing credentials for container deployment permissions.
Exploiting the stolen credentials, the hackers deployed malicious programs and gained unauthorized access to wallet signature services. At approximately 20:05 UTC on that day, an enormous volume of cryptocurrency assets began to be transferred out.
In merely four minutes, five hot wallets lost more than 233 million Ripple (XRP), followed by the discovery of thefts involving Bitcoin (BTC), Ethereum (ETH), and other assets shortly thereafter.
Although Binance promptly suspended withdrawals, the malicious on-chain authorization continued to facilitate fund transfers, and it took several hours before the security measures were fully implemented.
Binance reported that this cyber attack cumulatively resulted in losses of approximately $6.34 billion, with about $2.85 billion already frozen or intercepted.
On Tuesday, John Teng stated that Binance had compensated for 98% of the affected token assets, while still in the process of acquiring the remaining assets with lower liquidity.
The FBI has officially attributed the attack to the North Korean hacking group TraderTraitor, a claim that has been denied by North Korea.
As of Tuesday, Teng conveyed that Binance had rebuilt its compromised wallet systems and internal AI tools, replaced damaged devices, deactivated credentials and tokens related to the affected engineers, and expanded the scope of security scans for employee devices.
“We are engaging an independent expert to review all measures we have taken and will continue to strengthen our defenses as the investigation progresses,” he noted. “We are working tirelessly with law enforcement and industry partners to track and freeze the stolen funds.”
In the report, Binance also indicated that in 2026 alone, they had identified and thwarted 57 hacking attempts linked to North Korea.
Despite the enormous financial impact of the cyber attack, market reactions have been relatively muted. On the day of the attack, Bitcoin dipped more than 4% to $76,000, but the decline eased over time, with trading prices around $77,600 by Tuesday.