Binance Confirms $6.3 Billion Crypto Theft, Blamed on North Korea

Binance has confirmed that hackers stole $6.3 billion in cryptocurrency from its systems, a theft TechCrunch described as a record heist. The theft occurred on or about October 29, 2026. That day, Reuters reported that the exchange had disclosed a security incident, and cryptocurrency prices fell after the news.

Binance suspended customer withdrawals across its network after the hack. The FBI and blockchain investigators have blamed North Korea. Chainalysis, a blockchain analytics firm, attributed the attack to TraderTraitor, a North Korean cybercrime group. In an alert dated October 31, the FBI said North Korea was responsible for the attack on Binance.

Binance said it had covered $6 billion of the $6.3 billion stolen and that less than 10% of the stolen funds remained to be sourced. Reuters reported that the exchange then resumed Bitcoin withdrawals after covering the bulk of the losses.

According to Binance, the intrusion began with a social engineering campaign, meaning a con aimed at people rather than code. Binance said North Korean hackers used fake social media profiles and a job offer, sustained over months, to trick an employee into running malicious software. Hackers posing as recruiters contacted a software engineer on Binance's wallets team, conducted two interviews, and then sent a coding assignment containing malicious code that compromised the engineer's work laptop. Binance said its security tools did not detect the malware in that assignment.

From that foothold, the attackers reached an internal tool that could take over the work computers of two other wallet-team engineers. Binance also said one engineer had downloaded a tampered app containing password-stealing malware months earlier. The hackers used that engineer's stolen credentials to break into a third engineer's computer, a machine with access to systems controlling billions of dollars in crypto. Binance said the attack "should not have happened" and that it has improved its network security since the theft. The company said it faced at least 57 suspected attacks from North Korea.

Researchers have warned for years that North Korean hackers pose as venture capitalists, investors and recruiters, using dossiers of stolen American identities to trick employees into granting system access. According to figures, about half of all intrusions at U.S. tech companies last year were attributed to North Koreans posing as remote IT workers and fake recruiters. Analysts said the $6.3 billion Binance hack could be the largest financial heist of all time.

Experts accuse the government of North Korean leader Kim Jong Un of relying on cybercrime to finance itself. Pyongyang has long denied doing so.

In my view, the most instructive detail is the attack path rather than the dollar figure. The initial compromise did not exploit a zero-day, meaning a previously unknown flaw, in a custody system. It exploited a hiring process, in which a take-home coding assignment was run on a corporate laptop, and then it exploited the lateral reach of internal admin tooling, meaning how easily an attacker can move from one machine to others. Those are two different control families. Tightening recruiting and treating candidate-supplied code as untrusted is a process problem. Limiting what a single engineer's workstation can reach, especially machines that touch signing keys or hot wallet infrastructure, is an architecture problem. Binance's own account suggests both gaps were present at once.

The broader context here is that the same tactics have been documented against many employers, not only exchanges. The defensive lesson is not new, but it is now more costly to ignore. Endpoint detection that misses a payload delivered through a legitimate-looking assignment is a reminder that behavioral monitoring and privilege separation matter as much as signature-based tools. The encouraging part is that these failure points are specific and fixable. Binance's replenishment of most of the stolen assets, and its resumption of Bitcoin withdrawals, show that a large loss can be absorbed without core functions staying offline indefinitely. The incident makes clear that the next attempt will depend on how quickly firms rebuild their hiring and access controls, not on whether the threat is real.