Binance’s $6.3B breach turns a job interview into crypto’s biggest plot twist

Binance completed an initial investigation into the October 29, 2026 security incident that drained approximately $6.3 billion from its hot wallets, describing the event as a complex, months-long campaign and the largest cryptocurrency theft on record. The exchange said the affected assets spanned 10 blockchains, denied that wallet private keys were leaked and said the attack involved unauthorized withdrawals submitted through compromised internal systems. Binance committed to covering every loss through its Secure Asset Fund for Users, futures insurance fund and corporate treasury without charging users.

Binance’s subsequent postmortem said the operation began in June, when a Wallet DevOps engineer installed a tampered Homebrew package while searching for an AI coding tool. Although Binance detected the malware and replaced the affected computer, attackers had already gathered information about the wallet team. In September, another software engineer was approached through a legitimate recruitment platform and persuaded to download a malicious coding assignment during a fake job interview. On October 20, attackers used that compromised computer and an internal AI tool to reach two additional engineers, obtain deployment credentials and install malicious software within Binance’s wallet infrastructure on October 29.

The Ethereum leg of the attack used EIP-7702, an Ethereum Improvement Proposal introduced in May 2025 as part of the Pectra upgrade that allows ordinary wallets to delegate execution to smart-contract code. According to TRM Labs, 50 pre-signed authorizations were prepared in advance, allowing an affected Binance hot wallet to operate as a controlled “sweeper.” Binance co-CEO Richard Teng said the delegation “did not pass through our normal approval controls,” while Blockaid CEO Ido Ben-Natan said attackers could have stolen the funds without EIP-7702 but may have used it to bypass checks and consolidate transfers. Teng also said a self-destruct mechanism erased tools and traces, making the intrusion more difficult to reconstruct.

The FBI attributed the theft to North Korean operators it calls TraderTraitor, identifying the Democratic People’s Republic of Korea as responsible for taking more than $6 billion from Binance. The bureau said the hackers were converting stolen assets primarily into Ether and were expected to use DeFi and instant-swap services for further laundering. TRM Labs attributed the attack with “high confidence,” while Chainalysis cited the commingling of Binance proceeds with funds from September’s Bitget exploit. North Korea denied involvement, with Kim Yo Jong calling the FBI finding a “grave political provocation.”

Approximately $2.85 billion, or 44% of the haul, has been frozen or seized, according to Elliptic, which reported that about $3.11 billion remained in addresses linked to the theft as of its latest analysis. Binance has said around $3 billion was frozen with help from blockchain partners, including Tether’s USDT, Circle’s USDC, Ripple USD’s RLUSD, World Liberty Financial USD’s USD1, StraitsX USD’s XUSD, USDT0, Wrapped Beacon ETH’s WBETH, Tether Gold’s XAUT, Pax Gold’s PAXG, Pax Dollar’s USDP and Arbitrum’s ARB. Elliptic said the laundering had become “highly complex and clearly automated,” spreading more than $3.46 billion in stablecoins through at least 20,000 wallets on 16 blockchains, at least 36 services and at least 65,000 transactions.

Binance replenished 95% of the affected assets before reporting 98% coverage as of October 31, while continuing to acquire remaining tokens through market and over-the-counter channels. It phased withdrawals across 15 networks from Sunday, with $BTC withdrawals among the first restored, and said customer withdrawals had stabilized after initial net outflows of about $3.64 billion during the first nine and a half hours. Binance founder Changpeng Zhao said the exchange covered the losses from its balance sheet: “Binance did not borrow money. Binance did not sell assets. Binance did not raise money. Binance covered from its balance sheet.”