Binance has disclosed how attackers pulled off a $6.34 billion theft from its wallets, tracing the breach to an engineer who was deceived through a fake recruitment process and downloaded malicious software onto a work computer. The Binance hack, described by the exchange as the product of months of preparation, has been attributed by the FBI to North Korean cybercriminals.
A fabricated hiring process and a tainted download
According to Binance’s security update, the operation did not begin with a direct assault on its wallets. In June, an employee the company calls Engineer A installed a modified Homebrew package found through an online search. Binance says it detected and addressed that incident, but details about the employee later reached the attacker.
In early September, a second staff member, Engineer B, was approached on a legitimate job-hunting platform. The supposed recruiter conducted a video interview and supplied social media accounts and personal photographs that appeared authentic. A second-round interview followed in an online chat, and near its conclusion Engineer B was told to download an assignment that contained a malicious code repository onto his work computer.
Binance said the malware used elaborate obfuscation and evasion methods, including swapping out a legitimate development tool component for a malicious one. That allowed commands to run and communications to be established with a server controlled by the attacker. Steps were also taken to conceal the activity.
From engineer access to wallet control
Toward the end of October, slightly more than a week before the theft, the intruders used their foothold on Engineer B’s machine to take control of wallets tied to Engineer A, who had been compromised months earlier, and to another staff member identified as Wallet Software Engineer C.
On October 29, the attackers logged into Software Engineer C’s computer using stolen credentials and launched the operation. Binance said unauthorized access to an internal wallet signing service was used to initiate transactions that bypassed the normal withdrawal process. The theft unfolded in roughly 20 minutes, with funds moving across more than 10 blockchains.
Binance did not directly name the TraderTraitor group as the perpetrator. It referenced the FBI’s attribution to North Korea and said its security team had detected and prevented 57 suspected North Korea-linked cases during 2026. The company also apologized to users, partners and the industry, said it had set aside funds to cover losses, and reported that affected internal systems had been rebuilt or replaced.
Frozen funds and a laundering race
Nearly half of the stolen $6.34 billion was frozen where possible by parts of the cryptocurrency sector, leaving the hackers unable to reach those assets. Billions remain under the attackers’ control, however, and efforts to launder the proceeds into accessible form could stretch over months.
Rafe Pilling, senior director of threat intelligence at Sophos, said the campaign fits the TraderTraitor pattern. In his view, the intruders did not merely take a wallet key; they compromised engineers, used that access to learn how the environment worked, and then subverted the systems that authorize transactions. Pilling described the initial compromise as only a foothold, with the real attack engineered around how the victim moves money.
Blockchain analysis firms are tracking the laundering. Elliptic cofounder and chief scientist Tom Robinson wrote that the process has been highly complex and likely automated. In the first three and a half days, he said, about 12,000 wallets across 11 blockchains were used, averaging roughly one new wallet every 25 seconds and more than 40,000 transactions. TRM Labs estimates that North Korea-linked hackers have stolen about $12 billion in cryptocurrency since the start of 2017, with more than half of that total taken in heists this year.
How much of the money ultimately reaches North Korea is uncertain. A report last year by the Multilateral Sanctions Monitoring Team, which includes experts from the United States, South Korea and nine other countries, said such funds can support the country’s nuclear weapons and ballistic missile programs. The report said the hackers rely heavily on Chinese underground banking and China-based facilitators, though they sometimes use facilitators elsewhere.
