Binance disclosed on Tuesday that North Korean hackers stole roughly $6.3 billion in cryptocurrency through a months-long scheme built on fake LinkedIn job interviews and malicious software. The company told reporters that attackers posed as recruiters to convince a wallet engineer to download a booby-trapped coding assignment, giving them a foothold inside Binance's systems. The heist, which unfolded over several hours on October 29, is the largest theft in crypto history.
The FBI and blockchain investigators have blamed North Korea for the attack, and multiple crypto tracing firms have linked it to the TraderTraitor group, which stole more than $1.5 billion in a separate hack last year. Binance says customer funds are safe, that it has replenished 98% of the stolen coins from reserve funds and other sources, and that it re-enabled withdrawals on Saturday after a roughly 48-hour freeze.
How the Binance hack unfolded
According to Binance's security update, the operation was not a single breach but the accumulation of months of patient social engineering. Engineers were targeted across separate vectors—one through a poisoned software download, another through a fake recruitment process—and the attackers combined what they learned from each to escalate their access. Binance said its security tools failed to detect the malware at the time.
Once inside, the hackers moved carefully. Binance says they exploited an internal AI tool to seize control of other wallet engineers' computers, then used stolen credentials to reach a wallet signing service that could authorize transactions. "This should not have happened, and we apologize for the concern, disruption and uncertainty it caused our users, partners and the wider industry," the company wrote.
- June 2026: An engineer identified as Engineer A downloads a tampered Homebrew installer after searching online; Binance says it detected and removed the software, but information about the employee was later exposed to the hackers.
