Binance says employee deception enabled hackers to steal over $6bn

Full account

Binance says hackers stole about $6.34 billion in cryptocurrency during an attack on 29 October, after spending months building access to the exchange’s systems. In a security update issued on Tuesday, the company described a chain of compromises rather than a single break-in. It said the incident disrupted withdrawals and caused concern among customers and partners, and apologised for the impact.

According to Binance, the attackers first approached an engineer who worked on the exchange’s wallet systems, posing as recruiters. After two interviews, they asked the engineer to download what appeared to be a coding task. The file contained malicious software that compromised the employee’s work laptop. The company said its security tools did not identify that malware. The initial access then helped the attackers move through the network and reach an internal tool that could take control of other engineers’ computers.

Binance also described an earlier compromise involving a different engineer. In June, an employee downloaded a tampered software installation found through an online search. Although the company detected the incident and replaced the laptop, the attackers later used stolen information to access another engineer’s computer. From there, they reached systems connected to a wallet-signing service and were able to authorise transfers outside the usual withdrawal process. Binance said the final operation involved hot wallets on more than ten blockchains and unfolded in roughly 20 minutes.

The exchange said it had rebuilt or replaced affected systems and set aside funds to cover the losses. It also reported that cryptocurrency firms froze almost half of the stolen assets where that was possible. The remaining funds were still under the attackers’ control, while efforts to move and cash them out could take months. Binance did not itself formally attribute the attack to a named group, but cited the FBI’s link to North Korea and said it had detected and stopped 57 suspected North Korea-linked cyber cases during 2026.

The episode fits a pattern of patient social engineering that security researchers have previously associated with North Korean operations: fake identities and professional opportunities are used to gain an employee’s trust before malware is introduced. Sophos threat-intelligence director Rafe Pilling said Binance’s account was consistent with the TraderTraitor group’s known approach, which involves compromising staff and abusing systems that approve transactions. The FBI and blockchain investigators attributed the heist to North Korea; Binance’s own account described the tactics and referred to the FBI’s assessment without making that attribution directly.

TechCrunch foregrounds the longer-running warnings about North Korean hackers posing as recruiters and the scale of the theft, and reports that Binance suspended customer withdrawals. The other report focuses more closely on Binance’s technical account of the breach, the recovery measures and the portion of funds frozen. The figures are rounded differently: one gives $6.34 billion, while TechCrunch describes the haul as $6.3 billion. The supplied reports also vary in how they characterise the initial infection: one centres on a fake interview and malicious coding assignment, while the other traces an earlier tampered software download in June as part of the wider chain.

• www.wired.com
• techcrunch.com