For almost a decade, North Korean cybercriminals have targeted the cryptocurrency industry—large and small. While these hacks have been frequent, the country’s hackers allegedly made off with their biggest heist to date last week when $6.34 billion was siphoned from the wallets belonging to crypto exchange Binance.
In a new security update issued on Tuesday, Binance detailed its initial findings into how the company was compromised and hackers were able to steal billions in just 20 minutes. The hack, according to Binance, was the result of an engineer falling for a fake job interview and downloading malicious software. The hackers were then able to move through the company’s network, exploit an internal AI tool, and gain access to a wallet signing service that allowed them to make transactions outside of normal withdrawal procedures.
“This should not have happened, and we apologize for the concern, disruption and uncertainty it caused our users, partners and the wider industry,” Binance wrote in its security update, where it also says it has set aside funds to cover the losses and has “rebuilt or replaced” internal systems impacted in the attack. “It was not a single isolated breach or a simple phishing incident,” the company says.
Although more than $6 billion was stolen from Binance accounts, almost half of this—where it was possible to do so—was frozen by parts of the cryptocurrency industry, meaning the hackers could not access the funds. However, that still leaves billions controlled by North Korea’s hackers, who have been trying to launder the stolen money into a form where it can be accessed and cashed out. That process could take months.
Binance’s analysis says the hack was the accumulation of months of work by hackers, with the ultimate attack taking place on October 29. Shortly after funds started to be moved from Binance’s hot wallets, across more than 10 different blockchains, multiple cryptocurrency tracing firms attributed the attacks to the Democratic People’s Republic of Korea’s (DPRK) hackers, in particular the sophisticated TraderTraitor group that previously stole more than $1.5 billion in a separate hack last year. The FBI quickly linked TraderTraitor to the Binance hack on October 31.
“Binance’s account aligns with what we know about the TraderTraitor playbook,” says Rafe Pilling, a senior director of threat intelligence at security company Sophos. “The attackers didn’t simply steal a wallet key. They compromised engineers, used that access to understand and move through the environment, and ultimately subverted the systems used to authorize transactions.”
Binance stops short of directly blaming the TraderTraitor hackers itself; however, the company points to the FBI’s attribution to North Korea and acknowledges a prior targeting by DPRK’s cybercriminals. “Throughout 2026, Binance's security team detected and prevented 57 suspected North Korea-linked cyber threat cases,” the company’s update says.
