The FBI has attributed the theft, which Bitdefender estimates at $6.3 billion, to TraderTraitor, a North Korean hacking operation linked to Lazarus, after Binance's own incident report traced the attack back to a fake job interview. The Register reported that the FBI's alert named the group, and that Binance's report described a months-long campaign rather than a single break-in.
Binance put the damage at approximately USD 6.34 billion in digital assets impacted. In its report, the exchange wrote: "It was not a single isolated breach or a simple phishing incident." The Register quoted the line. The report listed fake job interviews, malware downloads, compromised internal AI tooling, endpoint takeover and an "advanced transaction-authorization method" as the chain that produced the breach.
Ars Technica, citing the FBI and the security firm TRM, reported that the heist initially targeted $6.34 billion from Binance wallets. "The $6.34 billion represents the biggest sum ever targeted in a cryptocurrency theft." the outlet wrote. Bitdefender said the breach dwarfs earlier thefts, including the $1.5 billion Bybit heist in February 2025, which was also attributed to North Korean hackers.
How Did a Fake Job Interview Reach Binance's Wallets?
The Register reported that preparation began in June with a supply chain attack, when a Binance engineer downloaded a malicious Homebrew installation. Ars Technica reported that Binance said the people behind the heist began no later than June.
The social engineering came later. According to The Register, in September another Binance software engineer was contacted via a "legitimate job-hunting platform" by someone purporting to be a project director, who arranged a series of interviews with a fake company. Binance's report says the engineer, identified as Software Engineer B, had a profile on a job-hunting platform that referenced his experience at Binance.
The first interview was a live video call with a fake HR representative. The Register reported that the interviewer shared a social media account with the engineer, complete with personal photos and videos, to build trust. In the second interview, someone purporting to be the CEO of the phony company appeared on a "popular social chat app" and told the engineer to download an "assignment." It was a code repository laced with malware.
Binance said the "0-day malware" was not detected by its endpoint security tools at the time. The Register put it the same way: the tools did not immediately flag it.
What Happened Inside the Wallet Systems?
From that first compromised machine, The Register reported, the attackers used the computer and an internal AI tool to reach the computers of wallet DevOps Engineer A and wallet software developer Engineer C. The Register dated that step to October 20.
Binance's report fills in the final approach. On 29 October, between 17:15 and 19:56, the attacker logged onto Software Engineer C's computer using credentials stolen from Wallet DevOps Engineer A. The attacker then deployed a container and triggered a malicious script to launch the attack.
The attackers then went after the signing service. Binance said they used it to exploit Ethereum's EIP-7702 authorization mechanism, giving an attacker-controlled smart contract partial execution rights over a Binance hot wallet. To set that up, the exchange said, they submitted 50 signing transactions to manipulate the account nonce and establish malicious delegation authorizations.
The payout was fast. Between 20:05 UTC and 20:09 UTC, five Binance hot wallets sent 233.46 million XRP to an attacker-controlled address, according to the incident report. Bitdefender reported that blockchain investigators estimate the attackers stole $6.36 billion across 10 blockchains, moving most of it within 20 minutes. Binance said it found no evidence that wallet private keys were leaked.
How Much Has Been Recovered?
Estimates of the total vary by who is counting. TRM Labs put the haul at $6.36 billion, and The Register reported that most of it disappeared in about 20 minutes. Elliptic puts the total closer to $6.43 billion.
Binance says approximately USD 2.85 billion in digital assets have been frozen or intercepted, subject to reconciliation and market price volatility. Elliptic told The Register it has verified that $2.85 billion of the stolen assets have been frozen or seized. Bitdefender noted that initial reports had indicated nearly $3 billion frozen, including more than $1.5 billion in USDT by Tether and approximately $800 million in USDC by Circle.
On the customer side, Binance said that as of 31 October 2026, 98% of the impacted token assets had been replenished and were verifiable on its Proof of Reserves page. The Register reported that the exchange recorded approximately $3.64 billion in net outflows after withdrawals resumed, which the company said was only around 2.1 percent of its reported assets.
The FBI warned that the hackers have started swapping their loot for Ethereum. Investigators expect them to move funds through DeFi platforms and instant swap services, The Register reported. Bitdefender said the bureau published 628 cryptocurrency addresses associated with the theft, including 608 Ethereum addresses, 19 Bitcoin addresses and one Solana address.
