Binance’s $6.3B Hack: The 20-Minute Sweep That Took Months to Prepare

Binance attackers spent months infiltrating the exchange before moving roughly $6.3 billion in digital assets from Binance hot wallets on October 29, 2026, according to a postmortem released on November 3. The campaign began in June, when an engineer downloaded a tampered software package while installing an AI coding tool. In September, attackers posing as recruiters targeted another engineer with a malicious coding assignment, compromising the engineer’s computer and allowing them to steal deployment credentials used inside Binance’s wallet infrastructure. “This wasn’t one mistake or one breach — it was a months-long campaign,” Binance co-CEO Richard Teng said. Binance found no evidence that wallet private keys leaked.

On October 20, the attackers used the compromised computer and an internal AI tool to reach two additional engineers’ systems, according to Binance. Malicious software was installed within the wallet infrastructure on October 29, granting access to an internal signing service that authorizes cryptocurrency transactions and allowed funds to move outside the normal withdrawal process. On Ethereum, the attackers used EIP-7702 delegations to give a Binance hot wallet smart-contract execution authority. Blockaid CEO Ido Ben-Natan said compromised signing infrastructure likely enabled the theft, while EIP-7702 may have allowed the assets to be swept in one operation rather than through multiple transactions.

Analytics firms estimated the theft at approximately $6.36 billion to $6.4 billion across 10 blockchains, making it the largest cryptocurrency theft on record. Tether froze more than 1.567B USDT, while Circle froze 823 million USDC; Binance later reported that $2.85 billion had been frozen or intercepted with help from blockchain partners. The stolen assets included 18,270 $BTC, more than 420,000 $ETH, USDT, USDC, RLUSD, tokens on Tron, and assets across Arbitrum, Optimism, Base, Solana, XRP Ledger and other networks. Tether froze the stolen USDT on Ethereum 37 minutes after it reached the attacker’s wallet, while Circle froze all $823 million in stolen USDC before it could be swapped, according to Elliptic.

The FBI attributed the theft to North Korea’s TraderTraitor group on October 31, calling it North Korean malicious cyber activity. The agency said the attackers were converting the stolen assets mainly into Ether and were expected to use DeFi and instant-swap services for further laundering. It urged THORNode operators, RPC node operators, instant exchanges, DeFi services, blockchain analytics firms and other digital-asset providers to block transactions involving hundreds of Ethereum addresses, 19 Bitcoin addresses and one Solana address linked to the theft. TRM Labs and Chainalysis had also identified TraderTraitor, while North Korea later rejected the accusation. Kim Yo Jong, sister of North Korean leader Kim Jong Un, called the FBI finding a “grave political provocation.”

Binance said it would absorb the financial impact through its Secure Asset Fund for Users, corporate treasury and futures insurance fund. The exchange set aside more than $6.34 billion, including $5 billion already held in the affected tokens, and reported that 98% of affected token assets had been replenished as of October 31. Withdrawals were initially suspended while Binance rebuilt and tested its withdrawal service, then resumed in phases on Sunday, including $BTC withdrawals. Binance said customer assets were safe, although a CoinDesk review found that the compromised wallets had previously been included in a list of holdings backing customer balances. The exchange also released a proof-of-reserves snapshot and said a detailed postmortem would follow once every fact was verified.