The $6.3B Binance breach began with a coding test — and ended with a crypto-record heist

Binance suffered an estimated $6.3 billion security breach on October 29, 2026, in what investigators have described as the largest cryptocurrency theft on record. The FBI attributed the attack to North Korean hackers it calls “TraderTraitor,” while North Korea later rejected the finding as “a grave political provocation against the DPRK.” Chainalysis, TRM Labs and Singapore-based Pangolin Intelligence had also linked the incident to TraderTraitor.

Binance’s postmortem said the operation began in June 2026, when a Wallet DevOps engineer downloaded a tampered Homebrew installation while searching for a popular AI coding tool. After Binance detected the malware and replaced the affected device, attackers later approached another software engineer through a legitimate recruitment platform, conducted video interviews with people posing as an HR representative and a CEO, and sent a malicious coding assignment. On October 20, the attackers used that compromised computer and an internal AI tool to access two additional engineers’ systems and obtain deployment credentials.

“The malware employed sophisticated obfuscation and evasion techniques,” Binance said, adding that the breach was not “one mistake or one breach — it was a months-long campaign.” On October 29, attackers installed malicious software within Binance’s wallet infrastructure, reached its internal wallet-signing service and submitted unauthorized withdrawals. On Ethereum, they used EIP-7702 delegation to give a hot wallet smart-contract execution authority without passing Binance’s normal approval controls. Binance found no evidence that wallet private keys leaked.

Approximately $2.85 billion of affected assets had been frozen or intercepted, and the exchange said it had replenished 98% of the affected token assets by Oct. 31. Binance stated that “Binance will absorb the financial impact of these stolen funds, not our users,” using its corporate treasury, Secure Asset Fund for Users and futures insurance fund. The exchange has also reserved more than $6.34 billion, including $5 billion already held in the affected cryptocurrencies, and restored withdrawals in phases across 15 networks.

The FBI said TraderTraitor was converting stolen assets primarily into $ETH and was expected to use DeFi and instant swap services for further laundering. Tether froze more than 1.567B USDT, while Circle froze $823 million USDC. Chainalysis later observed more than $500 million moving through Tron addresses and further transfers to Bitcoin and Solana. Binance founder Changpeng Zhao said: “Binance did not borrow money. Binance did not sell assets. Binance did not raise money. Binance covered from its balance sheet.”