Binance, the world's largest cryptocurrency exchange, has revealed how attackers stole about $6.34 billion from its hot wallets on 29 October — a months-long campaign that began with a tampered software download in June, ran through fake job interviews in September, and ended with an internal artificial-intelligence tool being turned against the exchange's own engineers. The company and analysts tracking the incident describe it as the largest cryptocurrency theft on record.
Last updated 5 November 2026 at 21:00 PKT.
In its first detailed account of the breach, published on 3 November and titled "29 October Binance Security Incident: Initial Findings and Response Update", Binance said the attack "was not a single isolated breach or a simple phishing incident" but a "sophisticated, multi-stage campaign" that compromised three engineers over five months. On 31 October, the US Federal Bureau of Investigation, together with the US Secret Service and IRS Criminal Investigation, attributed the theft to TraderTraitor, a North Korean state-backed hacking group. North Korea has denied any involvement.
How the attack unfolded
According to Binance's report, the intrusion began in June, when an engineer on its wallet DevOps team searched online for a popular AI coding tool and installed a tampered version of Homebrew, a widely used software installer for Mac computers. A person familiar with the incident told Reuters the malicious version had been placed in an advertisement, so it ranked above the legitimate download in search results. Binance said its security team detected the activity, replaced the device and rotated credentials — but by then the attackers had already learned the engineer's role and who their colleagues on the wallet team were.
The decisive stage came in September. A second engineer was approached on a legitimate job-hunting platform — Fortune reported it was LinkedIn — by someone posing as a project director. A video interview with a fake human-resources representative followed, then a second interview, over a chat app, with a person claiming to be the chief executive of a company that does not exist. Near the end of the process, the engineer was asked to download a coding assignment onto a work computer. Its setup process replaced pyenv, a legitimate developer tool, with a poisoned version that contacted an attacker-controlled server and removed traces of its activity. Binance said its endpoint security did not detect it.
The attack chain matters because it shows how a single compromised laptop became a route into the systems that sign transactions. No private key was leaked, according to Binance — the attackers instead reached the service that asks wallets to sign, and used it from inside.
On 20 October, the attacker used the compromised machine and an internal Binance AI tool to take control of the computers of two other engineers. One of them — the engineer compromised in June — held a container-deployment permission token: effectively a key that lets software be installed onto production servers. On 29 October, the attacker logged into a third engineer's machine, used that token to deploy a container, and ran a script that reached Binance's internal wallet signing service, outside the normal withdrawal process.
Four hours that moved $6.34 billion
| When (UTC) | What happened |
|---|---|
| June 2026 | Wallet DevOps engineer installs tampered Homebrew while seeking an AI coding tool |
| September 2026 | Second engineer targeted through fake job interviews; malicious coding assignment replaces pyenv on a work Mac |
| 20 October 2026 | Attacker uses internal AI tool to take control of two more engineers' machines; finds deployment token |
| 29 October, 17:15 | Attacker deploys a container with the stolen token and reaches the wallet signing service |
| 29 October, 20:05–20:09 | Five hot wallets send about 233.46 million XRP to an attacker-controlled address in four minutes |
| 29 October, evening | About 970,500 SOL, 44.2 million OP and 18,270 BTC follow; final transfer of 2,961.9 ETH completes at 23:56 |
| 30 October, 00:10 | Binance clears the delegation on its largest affected wallet, Binance 14 |
| 31 October | FBI, Secret Service and IRS-CI attribute the theft to North Korea's TraderTraitor |
| 3 November | Binance publishes its initial findings |
The mechanics explain why suspending withdrawals did not stop the drain. About 50 signing transactions manipulated transaction ordering and set EIP-7702 delegations — a feature that lets a wallet hand execution to smart-contract code — giving the attacker's contract partial control of hot wallets. Because the wallets use multi-party computation, no single private key was available to revoke the delegation at once. Binance said it was forced to build new procedures to revoke the authorisations during the incident, which slowed its response.
Attribution: TraderTraitor, and a denial
The FBI said TraderTraitor was converting the stolen assets mainly into ether, and expects the group to try laundering the funds through decentralised finance and "instant swap services". Blockchain intelligence firms had reached the same conclusion days earlier on their own evidence: TRM Labs attributed the theft to TraderTraitor with high confidence on 30 October, and Chainalysis and Elliptic have also linked the activity to the group, according to reports by The Hacker News, Forbes and CoinDesk.
"The FBI attribution is the strongest statement available. The blockchain intelligence firms reached the same conclusion first, on their own evidence."
TraderTraitor, also tracked as Jade Sleet, UNC4899, Slow Pisces and Pressure Chollima, is a financially motivated North Korean cluster within the wider Lazarus umbrella. The FBI previously attributed the May 2024 DMM Bitcoin theft and the February 2025 Bybit theft — about $1.5 billion, the previous largest crypto heist — to the same group. North Korea rejected the latest finding: Kim Yo Jong, the sister of leader Kim Jong Un, called the US assertion "absurd rhetoric" in a statement published by state media.
Attribution is not the same as a completed investigation. Binance's account is an initial report, not a final one: the company has named no malware family and published no file hashes, domains or IP addresses for the endpoint stages, and an independent third-party review it has commissioned has not yet been published.
What has been recovered — and what customers got back
Binance said about $2.85 billion of the roughly $6.34 billion in affected assets has been frozen or intercepted, a figure subject to reconciliation and market price changes, down from an earlier estimate of about $3 billion. Tether alone said it froze more than 1.5 billion USDT.
The exchange said it has replenished about 98% of the affected assets, up from 95% on 1 November, and is buying the remaining, less liquid tokens through market and over-the-counter channels. The money came from part of its Secure Asset Fund for Users (SAFU), part of its Futures Insurance Fund and its corporate treasury, and Binance plans to refill SAFU to about $1 billion. Binance said it is repaying all customers whose funds were stolen, and that users will not bear the loss.
Customers moved quickly once withdrawals reopened. Between 06:00 and 15:30 UTC on 1 November, Binance processed about $4.65 billion in withdrawals against $1.01 billion in deposits — a net outflow of about $3.64 billion, the company said in a post on X. Withdrawal restoration continued in batches, with further batches scheduled from 04:00 UTC on 5 November.
Binance also disclosed that it detected and prevented 57 suspected North Korea-linked cyberthreats in 2026. On reserves, the company said a zero-knowledge proof for its 31 October snapshot shows backing of at least 1:1 for 10 tokens, including BTC, ETH and USDT, and that a new snapshot covering 44 tokens followed at 00:00 UTC on 4 November, with the proof expected to take 50 to 60 hours. CryptoSlate noted that the first proof reflects balances at the snapshot and does not establish Binance's current financial position or independently audit its solvency.
Why regulators are paying attention
The scale of the theft has sharpened a policy debate in Washington. US Commodity Futures Trading Commission chairman Michael Selig told CNBC the hack "proves our exact point" about the crypto market rules his agency proposed earlier in October, and pitched a federal registration option for offshore exchanges. US Senator Cynthia Lummis, a Wyoming Republican, argued the CLARITY Act would have given freezing teams better tools. Neither measure is law: the CFTC proposal is an advance notice of proposed rulemaking with public comments open until 14 December, and the CLARITY Act failed a US Senate procedural vote on 15 September.
For the industry, the lesson Binance's own report points to is narrower and more practical. The attack succeeded, by the company's account, without any evidence of a leaked private key. It needed a search ad, a fake recruiter, a deployment token sitting on an engineer's computer, and an internal AI tool with reach into other machines — and a signing service that accepted what a container asked it to sign. Exchanges, security researchers say, should treat developer laptops, deployment tokens and internal tools as part of the signing perimeter, and rehearse how fast they can revoke an authorisation before they need to.
Frequently asked questions
Was any customer money lost?
According to Binance, no. The exchange said it is covering the loss itself from its own funds and has replenished about 98% of the affected assets, with the remainder being bought back through market and over-the-counter channels.
How did the attackers get in without stealing a private key?
They did not need one, according to Binance. A stolen deployment token let them run code that reached the internal wallet signing service, which authorises transactions. The wallets use multi-party computation, so no single key existed to revoke quickly, and the attackers used EIP-7702 delegations that outlived the withdrawal pause.
Who does the FBI blame?
The FBI, the US Secret Service and IRS Criminal Investigation attributed the theft on 31 October to TraderTraitor, a North Korean state-sponsored hacking unit. Blockchain firms TRM Labs, Chainalysis and Elliptic reached the same conclusion independently. North Korea has denied involvement.
Is this the biggest crypto theft ever?
By the figures Binance and analysts have published, yes: about $6.34 billion, far above the roughly $1.5 billion taken in the Bybit hack in February 2025, which the FBI also attributed to TraderTraitor.
What is still unknown?
As of 4 November, no malware family, file hashes or command-and-control infrastructure for the pyenv implant had been published, nor the name of the assignment repository, which AI coding tool was searched for in June, or which internal AI tool the attacker abused. Binance has promised a detailed technical post-mortem and an independent third-party review.
Key takeaways
- About $6.34 billion left Binance's hot wallets on 29 October 2026 in under four hours — described by Binance and analysts as the largest cryptocurrency theft on record.
- Binance's 3 November report traces the breach to a months-long campaign: a tampered Homebrew download in June, fake job interviews and a poisoned coding assignment in September, and an abused internal AI tool in October.
- The FBI, Secret Service and IRS-CI attributed the theft to North Korea's TraderTraitor on 31 October; North Korea denies it.
- About $2.85 billion has been frozen or intercepted, and Binance says it has replenished about 98% of affected assets from its own funds.
- No private key was leaked, according to Binance — the attackers reached the wallet signing service itself, a warning for every exchange about where its real perimeter sits.
What to watch next: the 44-token reserve proof expected within days of the 4 November snapshot, the remaining 2% of replacement purchases, Binance's promised detailed technical post-mortem and independent third-party review — and whether the frozen-asset figure, still subject to reconciliation, holds as the stolen funds move through exchanges and swap services.
