Binance, the largest cryptocurrency exchange in the world holding an estimated $160 billion in assets, suffered the largest crypto theft in history in late October. It seems that $6.3 billion dollars in assets were stolen with $2.85 billion of the total being frozen or intercepted during the process. The attack was sophisticated and planned for months at the very least.
The initial theft happened within minutes, but the unauthorized transactions continued for amost four hours before Binance finally revoked the malicious authorizations and stopped the attack. Binance, which serves about 300 million users globally, said that it will cover the losses to make customers whole. And in an effort to prevent future thefts like this, the company said it would also increase investment in AI-based detection tools, endpoint protection measures, developer-environment security, and behavioral anomaly monitoring. The company also rebuilt its previously compromised internal AI tool and strengthened its internal access controls.
When the attack started, Binance noticed the activity and immediately mobilized a large security team of engineers, executives, and external blockchain analytics partners to attempt to rapidly assess and manage the situation. But even as the teams worked to contain the attack, the unauthorized transfers continued. The company was clearly dealing with a significant attack that had already moved well beyond its normal withdrawal infrastructure and couldn’t be stooped immediately.
The attackers have been identified as being from North Korea by the FBI in the United States, and multiple blockchain intelligence firms have specifically said group was TraderTraitor, a North Korean cybercrime operation. Notably, the attackers didn’t actually break cryptography systems or steal any wallet keys. Instead, their method was much more subtle than that. They actually gained access to internal Binance systems via well known social engineering tactics targeting employees in the company. Over time, those actions led to the insertion of malware into Binance systems that both leveraged and circumvented the company’s regular authorization infrastructure to ultimately steal the assets.
Early in the process, two Binance engineers downloaded malware that provided internal access to the attackers. The first compromise came in June when an engineer searched online for a popular AI coding tool and downloaded a tampered version of Homebrew, a legitimate macOS package manager, as part of the installation process. The Binance security team flagged that downloaded software as having an anomaly, replaced the computer, and changed all associated access credentials. However, some serious damage was done. The attackers were able to learn the engineer’s role, and they were able to identify additional colleagues working on Binance’s wallet infrastructure.
And then the second breach took place in September when another engineer, while working on a company laptop, engaged in a series of job interviews with a fake company who’s representative asked the engineer to download some code to do a test as part of the hiring process. That second download proved to be fatal. The code was obviously malicious, and the internal Binance security systems didn’t catch it. The compromised software remained undetected was then able to gain access to an internal AI system and also to a third engineer’s computer. The attackers then used those systems to start stealing the crypto in October, bypassing the company’s normal signing and withdrawal processes.
An interesting technical detail is how the attackers exploited the newly deployed Ethereum EIP-7702 authorization mechanism. This software allows an externally owned account to delegate certain execution rights to a smart contract without exposing its private key. The attackers then used Binance’s compromised signing infrastructure to establish unauthorized delegation permissions over the company’s hot wallet. This essentially gave a smart contract, which was now under their control, the ability to execute transactions that Binance had not previously intended to authorize. The cryptographic security of the underlying private key to the hot wallet was not broken. But the authorization infrastructure that controlled how the wallet could be used was certainly compromised.
Binance also used Multi-Party Computation (MPC) for its hot wallet. MPC is a system that distributes cryptographic keys among multiple participants and allows them to jointly authorize transactions without reconstructing the complete private key. However, this did not prevent the attackers from abusing the legitimate Binance signing process. It also complicated the company’s emergency response because there was no single private key available to immediately revoke the malicious EIP-7702 authorizations. Binance had to develop a specific procedure to revoke the authorizations through additional blockchain transactions, which was a time consuming process compared to the rapid speed of the withdrawals.
Some obvious question come to mind here:
Employee Security: How did the attackers get an engineer to download the specific software that was compromised initially after some random searches on the web? And how could another engineer with privileged access to secure internal systems feel free to download and run untrusted external software on a company laptop during a job interview while on company time?
Infrastructure Security: How did a single compromised laptop provide such an easy pathway into an internal AI system, other laptops, and eventually the wallet infrastructure without being detected as malicious?
Authorization Security: How could compromised internal systems go undetected for so long and enable the automated authorization of transactions involving billions of dollars without effective independent safeguards — including human approvals for large transfers — to stop them?
Incident Response: How could the initial June breach not lead to a more comprehensive investigation of internal employee processes and policies, surrounding infrastructure, access credentials, and an immediate updating of all affected security systems designed to protect customer assets?
Binance: 29 October 2026 Binance Security Incident: Initial Findings and Response Update
The Register: North Korean fake job interview led to $6.3B Binance heist
Bloomberg: How Binance’s $6 Billion Crypto Heist Unfolded
Dana Love: Binance Hack? Binance Didn’t Get Hacked. They Got Suckered By A Ten-Year-Old Play
Reuters: Binance hackers used fake job interview in $6.3 billion attack
Patrick Boyle: North Korea Robbed Binance. Can Anyone Get the Money Back?
WSJ: How North Korean Hackers Pulled Off a $6.3 Billion Crypto Heist
Harry Donnelly: How the Biggest Theft in History Happened
Wikipedia: 2026 Binance hack
BTC Sessions: How Binance Got Hit By The BIGGEST HEIST In Human History
TFTC: Binance’s $6.3 Billion Single Point of Failure
TRM: North Korea Steals USD 6.36 Billion From Binance in the Largest Hack in History
This is not a comprehensive review, of course. There are many more technical reports that go into great detail being published by the security community. It’s a complicated attack because multiple cryptocurrency assets were involved, and the process to steal each one — and also stop the theft — was slightly different. That helps explain the nearly four hours of time needed for Binance to actually stop the action completely, and also why other involved partners were able to freeze their assets before Binance could. The list of links above provide more news and analysis of the situation.
It’s also interesting that there really isn’t that much anger on the Web about this crime. The story is well covered in the media, but the outrage is noticeably lacking. Perhaps the large balance sheet of Binance and the refunding of assets to customers helps explain the muted response of critics. It may be good business for Binance to cover the losses when legally it doesn’t have to, but on other hand, it’s likely that many customers would potentially leave if the assets weren’t refunded. Thus far, customer confidence seems to be holding. Keep in mind that Binance is massive in the crypto industry. The company managed over $34 trillion in trades last year alone. Nevertheless, this latest attack extends the ongoing trend of hacks in the crypto industry, and there doesn’t seem to be an easily visible solution to the problem.

