The key facts

  • The attack on Binance lasted from June to October: fake recruiting, malicious files and the use of an internal AI tool
  • The damage is estimated at about $6.3 billion; around $3 billion in assets were successfully frozen
  • The FBI linked the theft to North Korean activity known as TraderTraitor; Pyongyang rejected the accusations

How the Attack Unfolded

On November 3, the cryptocurrency exchange Binance published a report on the largest cryptocurrency theft in history: the company estimated the total damage at approximately $6.3 billion. According to the report, the attack began in June, when an engineer tried to install an AI tool for writing code. The security service noticed suspicious activity and replaced the employee's device and credentials, but by that point the attackers had already gathered information about his duties and colleagues.

Fake Interview and Access to Systems

In September, according to Binance's report, people posing as recruiters from a non-existent company invited another exchange engineer to a fake interview. A programming test task prompted the employee to download files containing malicious code onto his work computer, giving the attackers access to the company's systems. On October 20, they used the internal AI tool to gain access to the computers of two more engineers, and on October 29, using stolen credentials, they penetrated an internal wallet-signing service that approves transactions. In less than four minutes, 233.46 million XRP were withdrawn from five Binance wallets; this was followed by transfers of about 970,500 SOL, 44.2 million OP and 18,270 bitcoins. The exchange suspended withdrawals after detecting unusual transfers, but the permissions the attackers had already obtained did not allow all unauthorized transactions to be stopped immediately. On October 30, Binance announced that, thanks to cooperation with industry partners, about $3 billion in assets had been frozen on the blockchain.

Experts: Months of Reconnaissance and the Human Factor

Ari Redbord, head of global policy at the analytics firm TRM Labs, linked the attack to North Korea and noted that cyber thefts help finance the sanctioned government and its weapons programs. According to him, identifying engineers' names, determining who holds signing rights, and understanding how teams interact required months of research; job titles, professional profiles and conference participation help attackers map out targets. He called fake recruiters, sham interviews and malicious test tasks recurring methods associated with North Korean operations. Ersin Dincelli, an associate professor at the University of Colorado Denver, emphasized that even experienced engineers are vulnerable to social engineering that exploits curiosity, fear and a sense of urgency, while open-source intelligence tools and AI automation make it cheap to compile detailed profiles of victims. Redbord recommended running external code in disposable virtual environments on separate hardware, and for exchanges — introducing limits on hot wallets, withdrawal restrictions and delays for large transfers.

Accusations and Pyongyang's Response

On October 31, the FBI accused North Korea of stealing $6.3 billion in digital assets from Binance, linking the operation to activity known as TraderTraitor, and called on crypto companies to block transactions involving related addresses. Pyongyang rejected the accusations: Kim Yo Jong, sister of leader Kim Jong Un, stated that Washington is trying to portray the DPRK as a cybercrime state and suggested that the US may be interested in recovering the stolen cryptocurrency for its strategic reserves. Dincelli noted that the line between state-sponsored cyber operations and crimes for profit is blurring: while such attacks have traditionally been aimed at espionage and geopolitical goals, North Korea is demonstrating how they can be used to steal cryptocurrency and replenish the government's budget.

Scale Against Previous Records

The stolen amount is approximately 4.2 times larger than the about $1.5 billion stolen from the Bybit exchange in February 2025 — until this case, that had been the largest cryptocurrency theft in history. For comparison: the new attack is notable not only for its size but also for its lengthy preparation — from the initial intrusion in June to the withdrawal of funds at the end of October, each stage relied on previously gained access, which, according to Redbord, reflects a patient reconnaissance operation.