New turn in Binance theft as it gives the steps of the attack

This is about the theft of $6.34 billion from Binance, a crypto exchange, on 29 October. On 1 November 2026, the FBI in the US linked it to TraderTraitor, a group tied to North Korea.

Earlier: New turn in the Binance theft as the FBI names a North Korean group

Binance, a crypto exchange, said on Tuesday that hackers were in its systems for months before the theft of $6.34 billion on 29 October. Chief Richard Teng said the attackers used recruiter interviews as a trap, malware and a hacked internal AI tool. The tool gave them the system that approves wallet transactions. Binance says it put back 98 percent of the assets and will pay all customer losses.

How it works

In June, an engineer installed a copy of an AI coding tool from the web. The copy had malware. Binance found it and replaced the device.

But the hackers knew who worked on the wallet team. In September, hackers posed as recruiters and gave one more engineer a coding task with malware. By 20 October the hackers held 2 more devices. By 29 October they got the wallet tools.

The numbers

• Binance and partners froze about $2.85 billion.
• Binance stopped 57 tries by North Korean hackers in 2026.
• The first transactions moved almost $400 million. Then $1.4 billion in bitcoin left.

What is not known

Binance tools did not find the September malware. Binance says it was slow to stop the attack, as it had to make stop procedures during the attack. Teng did not name North Korea himself. North Korea denies it. An external expert examines the work.

Insight: Attackers aim at staff and trusted tools, not at software bugs

SOCRadar found that the n0n ransomware gang used weak or stolen passwords and no software bug. TraderTraitor used a tool download with malware and a recruiter task with malware. Binance tools missed the malware. This reads as a move to the easy entry through staff and tools that they trust, where a patch does not help. Look at how your staff install tools.