Binance Says Hackers Used Well-Known Tricks to Carry Out a $6.34 Billion Heist
6 min read
Summary
For almost a decade, North Korean cybercriminals have targeted the cryptocurrency industry—large and small. While these hacks have been frequent, the country’s hackers allegedly made off with their biggest heist to date last week when [6.34billion](https://www.wired.com/story/the−dollar63−billion−binance−hack−was−pulled−off−in−just−20−minutes/)wassiphonedfromthewalletsbelongingtocryptoexchange[Binance](https://www.wired.com/story/the−dollar63−billion−binance−hack−was−pulled−off−in−just−20−minutes/).InanewsecurityupdateissuedonTuesday,Binancedetaileditsinitialfindingsintohowthecompanywascompromisedandhackerswereabletostealbillionsinjust20minutes.Thehack,[accordingtoBinance](https://x.com/binance/status/2117626126214504729),wastheresultofanengineerfallingforafakejobinterviewanddownloadingmalicioussoftware.Thehackerswerethenabletomovethroughthecompany’snetwork,exploitaninternalAItool,andgainaccesstoawalletsigningservicethatallowedthemtomaketransactionsoutsideofnormalwithdrawalprocedures.“Thisshouldnothavehappened,andweapologizefortheconcern,disruptionanduncertaintyitcausedourusers,partnersandthewiderindustry,”Binancewroteinitssecurityupdate,whereitalsosaysithassetasidefundstocoverthelossesandhas“rebuiltorreplaced”internalsystemsimpactedintheattack.“Itwasnotasingleisolatedbreachorasimplephishingincident,”thecompanysays.Althoughmorethan6 billion was stolen from Binance accounts, almost half of this—where it was possible to do so—was frozen by parts of the cryptocurrency industry, meaning the hackers could not access the funds. However, that still leaves billions controlled by North Korea’s hackers, who have been trying to launder the stolen money into a form where it can be accessed and cashed out. That process could take months.
Binance’s analysis says the hack was the accumulation of months of work by hackers, with the ultimate attack taking place on October 29. Shortly after funds started to be moved from Binance’s hot wallets, across more than 10 different blockchains, multiple cryptocurrency tracing firms attributed the attacks to the Democratic People’s Republic of Korea’s (DPRK) hackers, in particular the sophisticated TraderTraitor group that previously stole more than 1.5billionina[separatehacklastyear](https://www.fbi.gov/investigate/cyber/alerts/2025/north−korea−responsible−for−1−5−billion−bybit−hack).TheFBI[quicklylinkedTraderTraitor](https://www.fbi.gov/investigate/cyber/alerts/2026/north−korea−responsible−for−6−billion−binance−attack)totheBinancehackonOctober31.“Binance’saccountalignswithwhatweknowabouttheTraderTraitorplaybook,”saysRafePilling,aseniordirectorofthreatintelligenceatsecuritycompanySophos.“Theattackersdidn’tsimplystealawalletkey.Theycompromisedengineers,usedthataccesstounderstandandmovethroughtheenvironment,andultimatelysubvertedthesystemsusedtoauthorizetransactions.”BinancestopsshortofdirectlyblamingtheTraderTraitorhackersitself;however,thecompanypointstotheFBI’sattributiontoNorthKoreaandacknowledgesapriortargetingbyDPRK’scybercriminals.“Throughout2026,Binance′ssecurityteamdetectedandprevented57suspectedNorthKorea−linkedcyberthreatcases,”thecompany’supdatesays.BinancesaysactivitylinkedtothehackcanfirstbetracedbacktoJunethisyear.Atthetime,itsupdatesays,anengineerthecompanyreferstoasEngineerAdownloadeda“tamperedHomebrewinstallation”theyfoundsearchingonline.Whilethecompanysaysthiswasdetectedanddealtwith,informationabouttheemployeewaslater“exposedtothehacker.”AtthestartofSeptember,Binancesaysanothersoftwareengineer,identifiedonlyasEngineerB,wascontactedon“alegitimatejob−huntingplatform”andthenattendedavideointerviewwherethefakerecruitersharedlegitimate−lookingsocialmediaaccountsandpersonalphotostomakethemseemreal.TheBinanceengineerprogressed,unsurprisingly,toasecond−roundinterviewthatwasconductedusinganonlinechat.“Neartheendoftheinterview,EngineerBwasinstructedtodownloadan‘assignment’containingamaliciouscoderepositoryontohisworkcomputer,”Binance’sreportsays.“Themalwareemployedsophisticatedobfuscationandevasiontechniques,includingreplacingalegitimatedevelopmenttoolcomponentwithamaliciousversiontoexecutecommandsandestablishcommunicationwithanattacker−controlledexternalserver,”thecompanywrites.Itaddsthathackerstookstepstohidetheiractivity,acommonpractice.TowardtheendofOctober,alittlemorethanaweekbeforethehack,Binancesays,theattackersusedtheiraccesstotheengineer’smachineto“gaincontrol”overthewalletofEngineerA,whohadbeencompromisedmonthsearlier,and“anotherWalletSoftwareEngineerC.”ThenonOctober29,Binancesays,theattackersloggedintothecomputerofanotherstaffmember,SoftwareEngineerC,andusedstolenlogindetailsbeforelaunchingtheattack.Ontheeveningofthetheft,accordingtoBinance,theattackunfoldedquickly.“Theattackerexploitedunauthorizedaccesstoaninternalwalletsigningservicetoinitiatetransactionsoutsidethenormalwithdrawalprocess,”thecompanywrites.Sophos’sPillingsaysTraderTraitor“excels”initsattacksthroughdetailedplanningandbeingabletounderstandhowtheservicesofthoseithacksoperate.“Theinitialcompromiseisjustafoothold,”hesays.“Therealattackiscarefullyengineeredaroundhowthevictimactuallymovesmoney.”WhileBinancesaysitsfindingsareonlytheinitialstepofitsinvestigation,securityandcryptotracingexpertssaythatthehackersareundertakingeffortstolaunderandcashoutthestolencryptocurrency.Sincethestartof2017,accordingtoanalysisbyTRMLabs,NorthKorean–linkedhackers[havestolenaround12 billion](https://www.trmlabs.com/resources/blog/north-korea-has-stolen-usd-128-billion-in-crypto-usd-74-billion-of-it-in-2026) in cryptocurrency—with more than half of that coming from heists this year.
Despite the astronomical sums, it is unclear how much of this money makes it back to North Korea. As in the Binance case, some cryptocurrencies can be frozen and made inaccessible, while other transactions can be blocked by some cryptocurrency exchanges. Crypto tracing company Elliptic has said the laundering from the Binance attack has been “highly complex” and likely to be automated. “In its first three and a half days it used about 12,000 wallets across 11 blockchains, roughly one new wallet every 25 seconds, and more than 40,000 transactions,” Elliptic cofounder and chief scientist Tom Robinson wrote in a blog post.
If the money can be laundered successfully, there is a chance it will be converted to cash and used to bolster the development of North Korea’s nuclear weapons program and ballistic missile systems, according to a report published last year from the Multilateral Sanctions Monitoring Team, which includes experts from the United States, South Korea, and nine other countries. “They are highly reliant on Chinese underground banking and China-based facilitators, though they sometimes rely upon facilitators in other countries.”
Comments
Back to top
