North Korean cybercriminals have targeted the cryptocurrency industry for roughly a decade, but the reported theft of $6.34 billion from wallets on the Binance exchange is the largest such heist to date. In a security update issued Tuesday, Binance said hackers spent months preparing the attack before exploiting an engineer through a fake job interview, moving through the company’s network and abusing internal artificial intelligence tools to access a wallet-signing service.
How the Binance attack unfolded
According to Binance, an engineer downloaded malicious software after failing a fake job interview. The attackers then used that access to navigate the company’s internal network and compromise an AI tool. From there, they reached a wallet-signing service that could authorize transactions outside Binance’s normal withdrawal process.
The company said the attackers were able to steal billions of dollars in approximately 20 minutes. Binance acknowledged the severity of the incident in its security update, stating: “This should not have happened, and we apologize for the concern, confusion, and uncertainty caused to our users, partners, and the entire industry.”
Binance said it had secured funding to cover its losses and had “rebuilt or replaced” internal systems affected by the attack. “This was not an isolated breach or simple phishing incident,” the company said.
Billions remain under attackers’ control
More than $6 billion was stolen from Binance accounts. Parts of the funds have since been frozen by organizations across the cryptocurrency industry, preventing the attackers from accessing them. However, billions of dollars reportedly remain under the control of North Korean hackers, who are attempting to move and launder the cryptocurrency so it can be converted into cash. That process can take many months, according to reporting cited in the source material.
TraderTraitor linked to the attack
Binance’s analysis said the breach was the culmination of months of activity, with the final attack taking place on October 29. Shortly after funds began moving from Binance’s hot wallet across more than 10 blockchains, several cryptocurrency tracking companies attributed the operation to hackers from the Democratic People’s Republic of Korea (DPRK), specifically the sophisticated TraderTraitor group.
TraderTraitor had previously been linked to the theft of more than $1.5 billion in another major cryptocurrency attack. The FBI identified the group in connection with that earlier hack and linked TraderTraitor to the Binance attack on October 31.
“Binance’s account is consistent with what we know about TraderTraitor’s playbook,” said Rafe Pilling, senior director of threat intelligence at security firm Sophos. “The attackers didn’t just steal the wallet keys; they compromised the engineers and used that access to understand and navigate the environment, ultimately subverting the systems used to authorize transactions.”
Binance investigation continues
Binance has not directly accused TraderTraitor itself. The company has, however, acknowledged the FBI’s assessment involving North Korea and said it has previously been targeted by North Korean cybercriminals.
“Throughout 2026, Binance’s security team detected and blocked 57 suspected North Korea-related cyber threat incidents,” the company said in its latest update.
Source: www.wired.com