Binance Suffers Record $6.34 Billion Loss in Sophisticated North Korean Cyberattack
A multi-stage campaign involving fake job interviews and AI abuse compromised Binance's internal infrastructure.
1Record-Breaking Security Breach
Binance reported a massive security incident resulting in the theft of approximately $6.34 billion in digital assets. The breach, occurring on October 29, is considered the largest cryptocurrency hack in history. The exchange confirmed that $2.85 billion of the stolen funds have been successfully frozen or intercepted by authorities.
2North Korean Attribution
The FBI has officially attributed the sophisticated campaign to North Korea-linked actors, specifically the group tracked as TraderTraitor, Lazarus Group, or APT38. Conversely, North Korean leadership, through Kim Yo Jong, denied these allegations, claiming the attribution is a politically motivated attempt to damage the nation's international standing and reputation.
3Initial Compromise in June
The operation began months prior in June 2026, when a Wallet DevOps engineer downloaded a tampered Homebrew installation while searching for AI coding tools. Although Binance detected the suspicious activity and rotated credentials, the attackers had already successfully mapped the roles and identities of the exchange's critical wallet team members.
4Fake Recruitment Strategy
In September, attackers targeted a software engineer via a legitimate job-hunting platform. Posing as a Project Director, they conducted two interviews, including one with a fake CEO. The process concluded by tricking the engineer into downloading a technical assignment that contained malicious code, which successfully bypassed existing endpoint security tools.
5Internal AI Tool Abuse
On October 20, attackers leveraged the compromised workstation to access an internal AI tool. This pivot allowed them to infiltrate the systems of two additional engineers. They discovered a token with container deployment permissions on one of the devices, which proved essential for gaining control over the exchange's wallet-signing infrastructure.
6Wallet Signing System Breach
By gaining access to the internal wallet-signing service, attackers bypassed standard withdrawal approval mechanisms. This allowed them to move funds outside the normal transaction flow. The breach was further complicated by the exploitation of Ethereum’s EIP-7702 mechanism, which enabled unauthorized transfers to persist even after the exchange attempted to suspend withdrawals.
7MPC System Limitations
Binance’s multiparty computation (MPC) wallet system, designed to distribute control over transaction signing, proved insufficient against this specific attack vector. The attackers used the stolen credentials to manipulate the signing process, making it difficult for the security team to effectively revoke permissions once the malicious activity had already been initiated.
8Exchange Response and Recovery
Binance co-CEO Richard Teng described the event as a months-long campaign rather than an isolated incident. The exchange committed to absorbing the losses to protect its customers. As of October 31, Binance reported that it had successfully replenished 98% of the affected token assets to maintain platform liquidity and trust.
9Ongoing Threat Landscape
Binance co-founder Yi He revealed that the security team had intercepted 57 suspected North Korea-linked cyber threats throughout 2026. These attempts included social engineering, malicious software packages, and fraudulent job interviews. Despite these successful preventions, the failure to stop this single, highly coordinated campaign resulted in severe financial consequences.
10Regulatory Impact in Korea
Following the breach, South Korean financial regulators, including the FSC, convened an emergency inspection meeting. They directed domestic exchanges to strengthen internal access controls and increase cold wallet storage proportions beyond the existing 80% requirement. Authorities are now coordinating with global agencies to prevent further market contagion from such breaches.
11Cold Wallet Security Focus
Regulators emphasized that cold wallets, which isolate funds from internet connectivity, are vital for reducing cybersecurity risks. The FSC is reviewing multisignature withdrawal verification procedures and administrator permissions across all major platforms. Exchanges are now required to maintain expanded emergency response staffing and establish rapid-reporting channels for suspicious transaction activity.
12Broader Industry Implications
The incident highlights the growing risk of recruitment-based social engineering in the crypto sector. Similar tactics were previously used in the 2016 Bangladesh Bank hack and the 2022 Axie Infinity theft. The event serves as a critical reminder for firms to prioritize employee education regarding the dangers of untrusted software downloads.