Binance has published its first detailed account of the October 29 attack that drained $6.34 billion from its hot wallets, describing a months-long operation that combined fake job interviews, malware and the misuse of an internal AI tool.
The world’s largest cryptocurrency exchange by trading volume said the campaign began as early as June, when attackers tricked a platform engineer into downloading a compromised version of the Homebrew software package. Binance’s security teams detected and removed the malware, but the intruders had already collected information on the engineer and colleagues.
In September the attackers approached a second engineer through a legitimate job-search platform. Posing as recruiters for a fictitious company, they conducted video interviews and shared personal social media profiles containing photographs and videos to build trust. During a second interview conducted over a chat app, the engineer was asked to download a coding assignment that contained sophisticated malware designed to evade detection. That malware established a persistent foothold inside Binance’s systems.
On 20 October the attackers used the compromised machine together with an internal AI tool to seize control of the computers of two wallet engineers. Nine days later they triggered a malicious script from one of those machines, using stolen credentials, and drained assets from multiple hot wallets within minutes. The operation, which lasted roughly four hours, moved large volumes of XRP, bitcoin and other cryptocurrencies to addresses controlled by the attackers.
The US Federal Bureau of Investigation has attributed the theft to the North Korea-linked group it calls TraderTraitor. Pyongyang has rejected the claim. Kim Yo-jong, the sister of leader Kim Jong-un, described the FBI’s assessment as “absurd rhetoric” and a “grave political provocation.”
Binance said approximately $2.85 billion of the stolen assets have been frozen or intercepted on-chain, preventing their further use or conversion. The exchange has drawn on its own reserves to replenish 98 per cent of the affected customer balances, with the remaining portion consisting of less liquid tokens still being acquired. Co-CEO Richard Teng confirmed the figure and stated that customers would not bear the losses.
The incident forced Binance to suspend withdrawals temporarily. When the service resumed in phases from 1 November, net outflows reached about $3.64 billion in the first hours as users moved funds. Major cryptocurrency prices fell sharply in the immediate aftermath of the theft, which is the largest on record and more than four times the size of the previous biggest exchange heist.
Binance has rebuilt the compromised wallet systems and AI tools and commissioned an independent cybersecurity review. The company said it had blocked 57 suspected North Korea-linked threats in 2026 alone, underlining the persistent targeting of the sector by sophisticated state-linked actors.
The attack illustrates how social engineering and multi-stage persistence can overcome even well-resourced defences when employees are successfully manipulated over extended periods.