For almost a decade, North Korean cybercriminals have targeted the cryptocurrency industry—large and small. While these hacks have been frequent, the country's hackers allegedly made off with their biggest heist to date last week when $6.34 billion was siphoned from the wallets belonging to crypto exchange Binance.
In a new security update issued on Tuesday, Binance detailed its initial findings into how the company was compromised and hackers were able to steal billions in just 20 minutes. The hack, according to Binance, was the result of an engineer falling for a fake job interview and downloading malicious software. The hackers were then able to move through the company's network, exploit an internal AI tool, and gain access to a wallet signing service that allowed them to make transactions outside of normal withdrawal procedures.
“This should not have happened, and we apologize for the concern, disruption and uncertainty it caused our users, partners and the wider industry,” Binance wrote in its security update, where it also says it has set aside funds to cover the losses and has “rebuilt or replaced” internal systems impacted in the attack. “It was not a single isolated breach or a simple phishing incident,” the company says.
Although more than $6 billion was stolen from Binance accounts, almost half of this—where it was possible to do so—was frozen by parts of the cryptocurrency industry, meaning the hackers could not access the funds. However, that still leaves billions controlled by North Korea's hackers, who have been trying to launder the stolen money into a form where it can be accessed and cashed out. That process could take months.
Binance's analysis says the hack was the accumulation of months of work by hackers, with the ultimate attack taking place on October 29. Shortly after funds started to be moved from Binance's hot wallets, across more than 10 different blockchains, multiple cryptocurrency tracing firms attributed the attacks to the Democratic People's Republic of Korea's (DPRK) hackers, in particular the sophisticated TraderTraitor group that previously stole more than $1.5 billion in a separate hack last year. The FBI quickly linked TraderTraitor to the Binance hack on October 31.
“Binance's account aligns with what we know about the TraderTraitor playbook,” says Rafe Pilling, a senior director of threat intelligence at security company Sophos. “The attackers didn't simply steal a wallet key. They compromised engineers, used that access to understand and move through the environment, and ultimately subverted the systems used to authorize transactions.”
Binance stops short of directly blaming the TraderTraitor hackers itself; however, the company points to the FBI's attribution to North Korea and acknowledges a prior targeting by DPRK's cybercriminals. “Throughout 2026, Binance's security team detected and prevented 57 suspected North Korea-linked cyber threat cases,” the company's update says.
Binance says activity linked to the hack can first be traced back to June this year. At the time, its update says, an engineer the company refers to as Engineer A downloaded a “tampered Homebrew installation” they found searching online. While the company says this was detected and dealt with, information about the employee was later “exposed to the hacker.”
At the start of September, Binance says another software engineer, identified only as Engineer B, was contacted on “a legitimate job-hunting platform” and then attended a video interview where the fake recruiter shared legitimate-looking social media accounts and personal photos to make them seem real. The Binance engineer progressed, unsurprisingly, to a second-round interview that was conducted using an online chat. “Near the end of the interview, Engineer B was instructed to download an ‘assignment’ containing a malicious code repository onto his work computer,” Binance's report says.
“The malware employed sophisticated obfuscation and evasion techniques, including replacing a legitimate development tool component with a malicious version to execute commands and establish communication with an attacker-controlled external server,” the company writes. It adds that hackers took steps to hide their activity, a common practice.
Toward the end of October, a little more than a week before the hack, Binance says, the attackers used their access to the engineer's machine to “gain control” over the wallet of Engineer A, who had been compromised months earlier, and “another Wallet Software Engineer C.” Then on October 29, Binance says, the attackers logged in to the computer of another staff member, Software Engineer C, and used stolen login details before launching the attack. On the evening of the theft, according to Binance, the attack unfolded quickly. “The attacker exploited unauthorized access to an internal wallet signing service to initiate transactions outside the normal withdrawal process,” the company writes.
Sophos's Pilling says TraderTraitor “excels” in its attacks through detailed planning and being able to understand how the services of those it hacks operate. “The initial compromise is just a foothold,” he says. “The real attack is carefully engineered around how the victim actually moves money.”
While Binance says its findings are only the initial step of its investigation, security and crypto tracing experts say that the hackers are undertaking efforts to launder and cash out the stolen cryptocurrency. Since the start of 2017, according to analysis by TRM Labs, North Korean–linked hackers have stolen around $12 billion in cryptocurrency—with more than half of that coming from heists this year.
Despite the astronomical sums, it is unclear how much of this money makes it back to North Korea. As in the Binance case, some cryptocurrencies can be frozen and made inaccessible, while other transactions can be blocked by some cryptocurrency exchanges. Crypto tracing company Elliptic has said the laundering from the Binance attack has been “highly complex” and likely to be automated. “In its first three and a half days it used about 12,000 wallets across 11 blockchains, roughly one new wallet every 25 seconds, and more than 40,000 transactions,” Elliptic cofounder and chief scientist Tom Robinson wrote in a blog post.
If the money can be laundered successfully, there is a chance it will be converted to cash and used to bolster the development of North Korea's nuclear weapons program and ballistic missile systems, according to a report published last year from the Multilateral Sanctions Monitoring Team, which includes experts from the United States, South Korea, and nine other countries. “They are highly reliant on Chinese underground banking and China-based facilitators, though they sometimes rely upon facilitators in other countries.”
