Binance says employee deception enabled hackers to steal over $6bn

Developing story first seen 2 hours ago

Wired · 2 hours ago

New details in Binance’s security update describe a months-long intrusion that culminated in hackers stealing more than $6 billion in about 20 minutes. The account matters because it shows how attackers allegedly used access gained through targeted employee deception to reach systems capable of authorising transactions outside normal withdrawal procedures.

Binance says an engineer downloaded a tampered software installation in June, and another was tricked into installing malware during a fake job interview in September. The company says hackers moved through its network, exploited an internal AI tool and accessed a wallet-signing service before moving funds across more than 10 blockchains on 29 October. Cryptocurrency firms froze almost half of the stolen funds where possible; the FBI linked the attack to North Korean group TraderTraitor, while Binance says it has set aside funds to cover losses and rebuilt or replaced affected systems.

Sources: 2
Outlets: 2
Left · Centre · Right: 0 · 0 · 0

In short

Binance says employee targeting enabled a months-long network breach.
Hackers stole more than $6 billion in about 20 minutes.
Crypto firms froze almost half of the funds where possible.

How this story developed

1 hour ago Binance added that the attackers may still control billions of dollars and could take months to launder them, while the FBI attributed the operation to North Korea’s TraderTraitor group.
1 hour ago Binance said hackers spent months targeting employees and moving through its network before stealing more than $6 billion across over 10 blockchains in about 20 minutes on 29 October.

Full account

Binance says hackers stole about $6.34 billion in cryptocurrency during an attack on 29 October, after spending months building access to the exchange’s systems. In a security update issued on Tuesday, the company described a chain of compromises rather than a single break-in. It said the incident disrupted withdrawals and caused concern among customers and partners, and apologised for the impact.

According to Binance, the attackers first approached an engineer who worked on the exchange’s wallet systems, posing as recruiters. After two interviews, they asked the engineer to download what appeared to be a coding task. The file contained malicious software that compromised the employee’s work laptop. The company said its security tools did not identify that malware. The initial access then helped the attackers move through the network and reach an internal tool that could take control of other engineers’ computers.

Binance also described an earlier compromise involving a different engineer. In June, an employee downloaded a tampered software installation found through an online search. Although the company detected the incident and replaced the laptop, the attackers later used stolen information to access another engineer’s computer. From there, they reached systems connected to a wallet-signing service and were able to authorise transfers outside the usual withdrawal process. Binance said the final operation involved hot wallets on more than ten blockchains and unfolded in roughly 20 minutes.

The exchange said it had rebuilt or replaced affected systems and set aside funds to cover the losses. It also reported that cryptocurrency firms froze almost half of the stolen assets where that was possible. The remaining funds were still under the attackers’ control, while efforts to move and cash them out could take months. Binance did not itself formally attribute the attack to a named group, but cited the FBI’s link to North Korea and said it had detected and stopped 57 suspected North Korea-linked cyber cases during 2026.

The episode fits a pattern of patient social engineering that security researchers have previously associated with North Korean operations: fake identities and professional opportunities are used to gain an employee’s trust before malware is introduced. Sophos threat-intelligence director Rafe Pilling said Binance’s account was consistent with the TraderTraitor group’s known approach, which involves compromising staff and abusing systems that approve transactions. The FBI and blockchain investigators attributed the heist to North Korea; Binance’s own account described the tactics and referred to the FBI’s assessment without making that attribution directly.

TechCrunch foregrounds the longer-running warnings about North Korean hackers posing as recruiters and the scale of the theft, and reports that Binance suspended customer withdrawals. The other report focuses more closely on Binance’s technical account of the breach, the recovery measures and the portion of funds frozen. The figures are rounded differently: one gives $6.34 billion, while TechCrunch describes the haul as $6.3 billion. The supplied reports also vary in how they characterise the initial infection: one centres on a fake interview and malicious coding assignment, while the other traces an earlier tampered software download in June as part of the wider chain.

Where outlets differ

From the full account, which is AI-written from the sources:

The headline and first report give the amount as $6.34 billion; TechCrunch rounds it to $6.3 billion.

TechCrunch emphasises prior warnings about North Korean social engineering and says withdrawals were suspended. The first report gives more detail on Binance’s security response, the frozen funds and the possible laundering timeline.

The first report describes a months-long sequence beginning with a tampered Homebrew installation in June and later involving a fake interview. TechCrunch foregrounds the recruiter impersonation and coding assignment, while also mentioning the earlier compromised software and stolen credentials.

Both reports relay links to North Korea, but Binance does not directly name TraderTraitor as responsible; the FBI attribution and Sophos expert assessment are reported separately.

Steelman: both sides, in good faith

The strongest fair case each way — we don't pick a winner.

The case for

The incident supports the view that sophisticated attackers can exploit employees and interconnected systems to bypass safeguards, making stronger access controls, independent transaction checks and better staff security training essential. Binance’s account of a months-long intrusion and rapid, cross-chain transfers suggests that prevention and recovery need to be planned across the wider cryptocurrency ecosystem, including cooperation to freeze stolen funds.

The case against

A security breach, however serious, does not by itself show that broad new controls are the best response: layered safeguards can impose costs, slow legitimate operations and still fail against well-resourced attackers. The account is Binance’s description of the incident, and the company says it has covered losses and rebuilt affected systems; careful investigation should establish what failed before drawing wider conclusions about the industry or its rules.

Explained simply

Binance is a large cryptocurrency exchange, where people buy, sell and store digital assets. Transactions are recorded on blockchains, which are shared ledgers, and some transfers require a wallet-signing service to approve them.

The reported intrusion began with attempts to deceive employees into installing malicious software. Binance says the attackers used access to its network to reach systems that could authorise transfers, then moved funds across several blockchains. The company says the FBI linked the attack to TraderTraitor, a group associated with North Korea.

The case matters because it shows how compromising staff accounts or devices can provide a route to systems that control large amounts of cryptocurrency. Binance says it has set aside funds to cover losses and replaced or rebuilt affected systems; other firms froze some of the stolen funds where possible.