Binance Covers $6 Billion of $6.3 Billion Stolen in Hack the FBI Links to North Korea

Binance says it covered $6 billion of the $6.3 billion stolen from its platform. The attack traces back to an intrusion that began in June, and the FBI has identified the actors as a North Korean unit it calls TraderTraitor.

According to Binance, the chain started when one developer downloaded a tampered installer distributed through a malicious Google ad. Binance's security teams detected the first malware installation that month and replaced the worker's device. The company said the June compromise also exposed details about its engineers and how they work.

In September, attackers targeted a second engineer while posing as recruiters. They ran a series of calls and several rounds of interviews, shared social media pages to build trust, and then asked the engineer to download a fake interview assignment. That assignment was malware. Binance said its endpoint security tools, the software that monitors laptops and workstations for suspicious activity, did not detect the resulting attack. The malware deleted the pyenv executable, a tool for managing Python versions, and replaced it with a malicious build that provided backdoor access, a hidden route for remote control. The company described the code as using obfuscation (deliberately scrambled code meant to resist inspection) and evasion, including replacement of a legitimate development tool component so it could run commands and communicate with an attacker-controlled server. Binance said the zero-day malware, a threat with no known signature, went undetected by endpoint protection at the time, and that the attacker removed traces to hinder detection and investigation.

By October 20, the attackers had used Binance's own internal AI tool to gain control of wallets belonging to the engineer compromised in June and to a third employee. On October 29 they logged into that third employee's computer and launched the attack. Wired reported that the theft was pulled off in just 20 minutes. Binance said its hot wallet, an internet-connected wallet used for routine transfers, relied on Multi-Party Computation (MPC), in which signing authority is split across several parties. As a result, there was no single private key it could immediately revoke to cancel the malicious EIP-7702 authorizations, which let an account delegate control to other code. Unauthorized transactions continued for nearly two hours after the first unauthorized transfers before Binance could stop them.

Several crypto-tracing firms said TraderTraitor may be behind the heist, according to Wired. The FBI's alert names the North Korean unit as responsible. Binance said it has prevented 57 suspected North Korea-linked cyber threat cases.

On recovery, Binance CEO Richard Teng said about $2.85 billion in stolen assets had been frozen or intercepted and that no user is bearing the loss. He said 98% of impacted tokens had been replenished and that withdrawals have broadly resumed. Reuters described the theft as the largest crypto hack in history, and describes Binance as the world's biggest cryptocurrency exchange.

In my view, the sequence matters as much as the headline figure. The initial foothold was a developer workstation, the lateral path ran through recruiting-themed social engineering and a development toolchain, and the final step went through an internal AI tool that touched wallet control. Custody keys were not the first point of failure. The workflow around the engineers was.

The broader context here is that MPC custody changed the response problem. With no single key to rotate, the operational question became how quickly authorizations could be revoked and transfers halted. Binance's account of nearly two hours of continued transactions puts that question at the center of the incident. Teng's figures on frozen assets and replenished tokens describe what recovery looked like after that gap, and whether they hold will depend on the continued work of the investigation and the freezing process.

What this enables is a clearer map of where exchange security now has to reach: endpoint integrity on engineering machines, verification of inbound recruiting contacts, and tighter control over what internal AI tooling can authorize. These are concrete engineering tasks, and the incident gives other custodians a detailed set of failure points to test against.