In September 2026, a Binance software engineer received a message from someone claiming to be a recruiter. His professional profile mentioned that he worked at the world’s largest cryptocurrency exchange, and the opportunity seemed credible. After two interviews, he was asked to download a coding assignment.
The company offering the job did not exist. The assignment contained malware, and the engineer’s computer became one stage in a months-long intrusion. On October 29, wallets controlled by Binance began sending cryptocurrency to addresses controlled by an attacker. Most of the initial withdrawals took roughly twenty minutes. The total reached approximately $6.34 billion, more than four times the previous record for a cryptocurrency theft.
The extraordinary part was not that someone had cracked Bitcoin or Ethereum. The transactions carried valid authorizations. The blockchain networks accepted them as they were designed to do. Understanding how those signatures came to exist leads from a fake interview, through compromised developer machines and an internal AI tool, into the machinery that protects billions of dollars in digital assets.
The Cryptocurrency Empire That Had Survived Almost Everything
Founded in 2017 by Changpeng Zhao, widely known as CZ, and Yi He, Binance became the largest cryptocurrency exchange by trading volume with remarkable speed. By 2026, Binance said it had more than 300 million registered users.
It had faced theft before. In May 2019, attackers obtained account credentials and security information, then withdrew 7,000 Bitcoin, worth approximately $40 million at the time, from one hot wallet. Binance covered the loss and promised stronger safeguards. A hot wallet is a cryptocurrency wallet connected to operational systems so a business can process withdrawals quickly; that convenience also creates an attractive target. The 2026 theft would be more than 150 times larger in dollar terms.
Legal and regulatory crises had tested the company too. In November 2023, Binance pleaded guilty in the United States to offenses involving anti-money-laundering requirements, unlicensed money transmission and sanctions violations, agreeing to pay approximately $4.3 billion. The US Justice Department’s account of the case describes an exchange that had pursued growth without controls required under American law. Zhao resigned as CEO, pleaded guilty to a related violation, and served roughly four months in prison. President Donald Trump pardoned him in October 2025.
Leadership passed to Richard Teng, joined in December 2025 by co-founder Yi He as co-CEO. Binance remained enormous, financially powerful and experienced at surviving public crises. None of that meant it was immune to an attacker who knew how to approach employees rather than confront the exchange’s defenses directly. The next breach began with tools and routines that would look ordinary in almost any technology company.
The Fake Job Interview That Opened the Door
Binance’s initial investigation published on November 3 describes not one entry point but a sequence of compromises separated by months. The first known incident occurred in June 2026, when a member of its wallet DevOps team searched online for a popular AI coding tool. The engineer downloaded a tampered version of the Homebrew installation process, giving an attacker an opening through software that appeared to be part of a normal developer setup.
This attempt was detected. Binance says its security team replaced the affected laptop and rotated associated credentials. The distinction mattered: replacing a computer did not necessarily undo what an intruder had learned about the people, permissions and systems surrounding it.
In September, another employee—identified in Binance’s report as Engineer B—was contacted through a legitimate job-search platform. The supposed recruiter presented himself as a project director, having apparently found a profile that mentioned the engineer’s Binance experience. Rather than immediately sending a suspicious file, the impostors constructed a recognizable hiring process. The first interview took place by live video with someone playing the human-resources representative, who shared a social-media profile containing personal photographs and videos. The second took place in a messaging application with a man claiming to lead the recruiting company.
There is nothing inherently suspicious about being interviewed on a video call, meeting a company’s CEO or receiving a short technical exercise. At the end of the second interview, the candidate was asked to download a coding assignment to his work computer. The repository included a malicious setup script that ran while the engineer prepared the project, before he had any reason to suspect the test was not what it claimed.
The script did not simply announce itself as malware. Binance says it used previously unseen techniques to evade endpoint protection, replaced a legitimate component of the pyenv developer tool with an attacker-controlled version, communicated with an external command server, and attempted to conceal the changes. A routine-looking coding environment had become a channel through which the attacker could issue instructions.
By October 20, the intruder was using that compromised computer as a starting point for further movement. According to Binance, the attacker exploited an internal AI tool to gain control over the machines of the earlier DevOps engineer, designated Engineer A, and another wallet software engineer, Engineer C. The AI tool was part of the internal environment the human attackers used to reach additional systems.
On Engineer A’s machine, the intruder found a token permitting container deployment. Containers allow software to be packaged and run within computing infrastructure; deployment permissions therefore matter because they can place programs in environments far beyond an individual employee’s laptop.
On October 29, between 17:15 and 19:56 UTC, the attacker accessed Engineer C’s machine, used credentials taken from Engineer A and deployed a container running a malicious script. This brought the operation to an internal transaction-signing service. Binance has not publicly disclosed every technical detail of that final escalation, and its findings remain subject to independent review. What is established in its account is the chain of opportunity: compromised developer software, a convincing recruitment trap, movement through internal systems, stolen deployment permissions and unauthorized access to the ability to sign wallet transactions.
Binance reported that its defenses had detected and blocked 57 suspected North Korea-linked threats during 2026, including malicious tools and fraudulent recruitment attempts. The campaign that succeeded belonged to a familiar family of tricks sometimes described as Contagious Interview or Operation Dream Job. It required one credible-looking request at precisely the right point in an employee’s working day.
How $6.34 Billion Disappeared Across Ten Blockchains
On Thursday, October 29, at approximately 20:05 UTC, five Binance hot wallets on the XRP Ledger started sending cryptocurrency to one attacker-controlled address. Between 20:05 and 20:09, they transferred a combined 233.46 million XRP, worth roughly $296 million at contemporary prices. Within minutes, Binance wallets on Solana and Optimism were sending out assets too. These were not customer withdrawal requests processed through the normal interface, but the networks saw valid signatures and recorded the transfers.
At around 20:20 UTC, a Bitcoin wallet sent 18,270 BTC, valued at approximately $1.47 billion, to an address controlled by the intruder. The attacker immediately divided the funds into smaller, round denominations, including 1,000-BTC and 100-BTC amounts. This splitting is often called a peel chain: instead of leaving one conspicuous balance, an operator creates many outputs that investigators must follow separately. About two minutes later, a Tron wallet transferred roughly 612.7 million USDT and 46.4 million TRX.
Ethereum was the largest single source of losses. Researchers at TRM Labs reconstructed the attack across ten blockchains, estimating approximately $3.79 billion in Ethereum-network assets, including Ether and a wide collection of other tokens. TRM calculated $6.36 billion in total using transaction-time prices, while Binance reported approximately $6.34 billion and Elliptic’s methodology produced a somewhat higher figure. Such differences reflect valuation timing and the scope of wallets and networks traced, not evidence of separate heists.
The startling feature was how ordinary the transfers looked from the blockchains’ perspective. Digital signatures demonstrate that a transaction was authorized using the relevant cryptographic credentials. They do not demonstrate that the company owning the assets intended the transaction. Once an attacker can misuse a trusted signing service, the network has no general way to distinguish the legitimate business purpose from a fraudulent instruction that arrives with a valid signature.
Most of the headline theft unfolded in about twenty minutes, yet that was not the end of the attack. Smaller outflows continued on other networks, and one Ethereum authorization would remain active for hours.
The Ethereum Feature That Kept the Theft Going
In May 2025, Ethereum introduced a capability known as EIP-7702, part of a broader effort to make ordinary cryptocurrency accounts more programmable. The Ethereum proposal lets an account authorize software at another address to execute code on its behalf.
An analogy is a power of attorney. A wallet can cryptographically sign instructions that delegate certain behavior to a smart contract, a program executing according to blockchain rules. This is not the same as surrendering the wallet’s private key, and permission design depends on the code involved. But if the account delegates to malicious software, that software can exercise the authority the account has granted it. The delegation remains recorded on-chain until a subsequent valid authorization changes or clears it.
The Binance attacker exploited another detail: nonces, the sequence numbers that help distinguish a wallet’s transactions and authorizations. An EIP-7702 authorization is valid only when its signed nonce corresponds to the account’s current state. Because Binance’s wallet was busy, its nonce could advance between the preparation of a malicious authorization and the moment a blockchain transaction tried to use it. A single pre-signed authorization therefore risked being rejected as outdated.
The attacker prepared 50 signed authorizations with different nonce values and submitted them together in an attempt to cover the possible sequence numbers. It was rather like bringing tickets for many consecutive queue numbers when the current number is changing too quickly to predict. The technique increased the chance that at least one would match the wallet’s state when the transaction was processed, establishing delegation to the attacker’s chosen program.
Around 20:20 UTC, the malicious delegation was established. Minutes later, at approximately 20:24, the attacker-controlled code triggered a sweep from a major Binance Ethereum wallet: more than 167,000 ETH, around 1.6 billion USDT, and numerous other tokens moved in a single burst. The failure lay upstream, where the attacker had obtained valid signatures and directed them toward a dangerous authorization.
This became especially consequential when Binance suspended withdrawals. Closing an exchange’s withdrawal interface can stop normal customer requests, and shutting down internal services can prevent new transactions from being initiated through those services. But it does not automatically erase a delegation already written to Ethereum. The malicious program could respond to calls on-chain and sweep newly arriving funds, and researchers identified repeated transfers after the first large withdrawal.
Revoking the permission was not as simple as typing a password into an administrator screen. Binance used multi-party computation, or MPC, to protect its hot wallet. In such arrangements, several participants jointly produce signatures without one participant holding an ordinary, complete private key.
The response team had to construct a special signing procedure to clear the delegation. The last unauthorized transfer, 2,961.9 ETH, was confirmed at 23:56 UTC on October 29, although Binance says it had been broadcast earlier and was pending. At 00:10 UTC on October 30, the company executed an authorization to the zero address, removing the malicious delegation from the affected wallet. Almost four hours had passed since the first unauthorized XRP transfers.
EIP-7702 was not itself a backdoor installed by the thieves. It was a legitimate feature whose security depends on careful control of authorizations and the contracts receiving them. A protective design at one layer could not compensate quickly enough for an authorization that another layer had already accepted.
The Race to Freeze Billions Before They Vanished
The stolen assets were not equally easy to move or protect. Bitcoin and Ether are native cryptocurrencies with no company able to blacklist a particular holder through an issuer-controlled contract. Stablecoins such as Tether’s USDT and Circle’s USDC, by contrast, are issued by companies whose token contracts can freeze addresses. For someone trying to steal billions, this distinction turned the first hour after the theft into a race between conversion and intervention.
At approximately 21:01 UTC, about 37 minutes after the main Ethereum sweep, Tether froze roughly $971 million in USDT in a principal attacker-controlled address. Circle followed about three minutes later, freezing approximately $823 million in USDC. Issuers had coordinated action within minutes of discovering an enormous crime, but the attacker had already enjoyed enough time to move or sell substantial portions of the freezeable assets.
Chainalysis tracked about $325 million in stablecoins exchanged for roughly $285 million in Ether, a hurried conversion at a steep discount. Professional liquidity providers could offer an immediate way to trade large quantities, but speed came at a cost that the attacker appeared willing to pay. The objective was not to obtain the best market price. It was to trade assets an issuer could lock for assets no issuer could freeze.
The attackers also placed approximately 60 million USDT into Aave, a decentralized lending protocol, and borrowed Ether against the deposit. Aave and its risk-management participants subsequently restricted affected markets. On Tron, additional USDT was converted to TRX before freezes took effect.
Other organizations joined the intervention. Ripple froze approximately $40 million in RLUSD; World Liberty Financial acted against its USD1 stablecoin and related tokens; and an emergency response by the Arbitrum Security Council secured roughly $30 million in assets on that network. Different controls were involved in each case, so it would be misleading to imagine one universal freeze button. Stablecoin issuers exercised token-specific powers, while Arbitrum relied on the emergency authority of network governance.
By Binance’s initial public accounting, around $2.85 billion had been frozen or intercepted. That is an extraordinary share of a cryptocurrency theft of this scale, but frozen does not automatically mean returned to the victim, and intercepted does not mean all associated legal or technical recovery steps are complete. Analysts’ early totals varied, with some counting approximately $2.7 billion before additional freezes and reconciliations.
The incident exposed a tension within the idea that cryptocurrency transactions cannot be stopped by centralized institutions. Bitcoin and Ethereum transfers cannot simply be reversed by calling an issuer. Yet a large proportion of assets traded on top of those networks are privately issued tokens with embedded controls, and much of this heist was contained because those controls existed. The thief escaped most readily with the assets that no issuer could immobilize.
The North Korean Fingerprints Behind the Attack
Forensic investigators were examining the stolen funds even as Binance was trying to stop their movement. TRM Labs attributed the attack with high confidence to TraderTraitor, a North Korea-linked hacking operation, based on on-chain activity and other intelligence. Chainalysis reached a similar conclusion, pointing in part to funds from the Binance theft appearing alongside proceeds connected to an earlier Bitget incident.
On October 31, 2026, the FBI publicly attributed the Binance theft to North Korea’s TraderTraitor operation. It released a long list of related cryptocurrency addresses and urged exchanges, blockchain infrastructure operators, decentralized-finance services and others to block transactions connected to those funds.
The preparation had recognizable fingerprints. TRM described small withdrawals from Tornado Cash that supplied an operator wallet with funds to operate on Ethereum, followed by tests of the malicious contract before the main theft. Signatures were prepared in advance and used in a concentrated burst. The group also moved quickly into complex conversion routes.
The most revealing parallel was not a cryptocurrency trick but another recruitment trap. In 2024, a North Korean operative posing as a recruiter contacted an employee at Ginco, a Japanese cryptocurrency-wallet software company, through LinkedIn. The supposed pre-employment test contained malicious Python code. According to the FBI’s investigation of the DMM Bitcoin theft, that compromise eventually contributed to the theft of 4,502.9 BTC worth approximately $308 million from DMM Bitcoin in May 2024. The frequently repeated figure of $35 million for that case is incorrect.
In February 2025, North Korean attackers were also held responsible for stealing approximately $1.5 billion from Bybit. That attack involved the compromise of infrastructure used to prepare and approve wallet transactions. Across these incidents, the common weakness was not necessarily one blockchain or one exchange. It was the route from a trusted employee or software supplier into a system capable of authorizing transfers.
North Korea has denied responsibility for the Binance attack. In reporting by the Associated Press, Kim Yo Jong, the sister of leader Kim Jong Un, rejected the FBI’s accusation as a political provocation. That denial deserves to be identified as the state’s position, while the FBI attribution and independent forensic conclusions must be evaluated on their own evidence. A public blockchain can reveal flows and relationships among addresses, but it does not display a passport alongside every transaction.
The broader context matters too. As explored in the history of North Korea, the regime has invested in cyber operations as a relatively inexpensive way to gain information, disrupt adversaries and generate revenue despite international restrictions. The Binance case fits that larger strategic pattern, without requiring every public allegation about North Korea’s cyber activity to be treated as automatically proven.
How Binance Replaced the Money and Faced Its Customers
Once the unauthorized transfers were stopped, Binance confronted a second crisis: customers wanted to know whether their assets were still there. The company’s answer was that it would absorb the financial loss rather than pass it on to users. It drew on its Secure Asset Fund for Users, other insurance and reserve resources, a Bitcoin reserve and corporate treasury funds to replenish affected assets. This distinction is central to the financial story. An exchange can replace stolen coins by buying equivalent assets even when the stolen coins remain in an attacker’s wallet.
In its November 3 report, Binance said it had set aside more than 100% of the funds required to cover the loss and that 98% of impacted token assets had been replenished as of October 31. The remaining assets were less liquid and therefore harder to purchase quickly in sufficient quantities. Replenishment is not recovery: replacing an asset with corporate money does not mean that asset has been retrieved from the attacker, nor that frozen balances have become available for immediate use.
Binance began reopening withdrawals on Sunday, November 1, starting with selected networks and assets. Between 06:00 and 12:36 UTC, the company said withdrawals were restored for all 15 networks and assets in its first phase. The process took just over six and a half hours, following security checks intended to prevent a return to normal operations before wallet services were considered ready.
The immediate response from users was measurable. Binance reported $4.649 billion in withdrawals between 06:00 and 15:30 UTC that day, offset by approximately $1.01 billion in deposits, leaving a net outflow of roughly $3.64 billion. Bloomberg described the first-day outflow as relatively contained in relation to the exchange’s overall size. Using Binance’s then-reported $171 billion in assets under management, the net represented about 2.1%. Subsequent reporting indicated that net withdrawals had grown to approximately $4.7 billion by November 2.
Binance also published proof-of-reserves information for major tokens and prepared a new snapshot dated October 31. A reserves snapshot cannot by itself explain how attackers obtained the signatures, why large balances were accessible through hot wallets or why emergency revocation took hours.
The company’s remediation plan included rebuilding affected wallet infrastructure and its internal AI tool, replacing devices, revoking credentials, strengthening wallet controls and commissioning an independent cybersecurity review. Binance’s financial capacity allowed it to replace assets on a scale most exchanges could not contemplate. That capacity should not be confused with proof that the same failure cannot recur.
Where the Stolen Cryptocurrency Went
Freezing funds is one operation; tracing what remains is another. Cryptocurrency transactions leave public records, so investigators can follow assets from an exchange wallet into other addresses. But an attacker can repeatedly divide balances, swap one asset for another, move between blockchains, and send funds through services designed to make the path difficult to reconstruct. In a theft involving billions of dollars, the resulting trail can quickly become an investigation of extraordinary scale.
The blockchain intelligence company Elliptic documented how the laundering developed. In the first three and a half days, investigators observed approximately 12,000 wallets across eleven blockchains and more than 40,000 transactions. This eleven-chain figure concerns the subsequent tracing of stolen proceeds; it need not match the ten-chain count in TRM’s initial theft reconstruction. Elliptic estimated that around $3.21 billion still remained in addresses linked to the theft as of its November 4 update, mostly in Bitcoin and Ether, while approximately $2.85 billion had been frozen or seized.
Some stolen assets barely moved. The 18,270 Bitcoin taken in the initial assault were divided among 19 addresses and, as of Elliptic’s November 4 update, had not been moved onward. The largest Ethereum holdings likewise remained concentrated in a small number of addresses. Large, relatively stationary balances may seem surprising after such an aggressive theft, but an asset that cannot be frozen does not have to be rushed through an expensive exchange. Moving it carelessly could make it easier to seize at the next point where an institution has control.
Other funds were handled very differently. Tron became an early center of activity, with stolen TRX distributed to thousands of newly created addresses. Some value crossed into Ethereum through bridges, services that take an asset on one blockchain and deliver corresponding value on another. On October 31, the laundering expanded through lending vaults that allowed assets to be deposited from one address and withdrawn to another.
The strategy continued changing. By November 2, the stolen 233 million XRP had been moved to six new addresses, although it had not yet been swapped or bridged in Elliptic’s assessment. Large quantities of stolen SOL subsequently moved through new wallets, lending and staking services, swaps and cross-chain bridges, with much of the value eventually converted toward Bitcoin. Between November 3 and 4, roughly 725,000 SOL, worth about $67 million at the reported prices, left the original theft wallet in a rush of transfers.
Some funds were also sent through privacy-enhancing tools. Elliptic found stolen value passing through Bitcoin coinjoins, which combine many inputs in a transaction, and through a privacy pool called Privacy Cash on Ethereum and Solana. By November 4, the amounts observed in mixing mechanisms were still small relative to the billions stolen.
The speed and regularity of the laundering suggest automation. Elliptic described repetitive amounts, fixed intervals, retry patterns and thousands of transactions that would be impractical to execute individually. On Tron alone, activity reached roughly 1,300 transactions in one hour. Conventional software scripts can perform repetitive actions at scale, while humans can still choose the routes and change them when necessary.
Even successful laundering is not necessarily the same as spending the proceeds. Converting USDT into Ether, Ether into Bitcoin, or tokens from one network into another mostly changes the form in which the attacker holds the value. Turning billions of dollars into money usable outside the blockchain world usually requires counterparties, such as centralized exchanges or over-the-counter brokers, who may detect and reject tainted assets. Elliptic judged that only a negligible amount had probably been cashed out by early November and expected the process to continue for months, as it had after Bybit.
The final picture is therefore neither a complete escape nor a complete recovery. Billions were frozen through issuer and network powers, billions remained under attacker control, and much of the remaining value was both highly visible on-chain and difficult to reclaim. Binance could make its customers whole with corporate resources, but that did not undo the theft itself.
The breach began when people trusted a professional-looking interview and computers trusted code presented as an ordinary development tool. It escalated when an attacker reached systems that could produce valid cryptocurrency signatures, and it persisted because an on-chain delegation survived the shutdown of the usual withdrawal channels. The blockchains did not need to malfunction for the theft to succeed; they only needed to honor authority that the attacker had managed to misuse.
For users, the question of trust cannot be answered by a slogan about decentralization or by a single figure showing how much an exchange can afford to reimburse. It involves employee security, control over signing systems, emergency procedures, the ability to recover assets and the transparency of investigations after something goes wrong. The Binance heist demonstrated how quickly those layers can fail together—and how expensive it is to discover the gap between a valid transaction and a legitimate one.
Last Updated on November 5, 2026 by Aseem Gupta