Binance Details $6.34 Billion Crypto Theft and Months of Intrusion

Binance’s account of the $6.34 billion cryptocurrency theft describes a months-long intrusion that ended with attackers using an internal wallet signing service to move funds outside the exchange’s usual withdrawal process. The company says the operation began with compromised engineers and culminated on October 29, when cryptocurrency was transferred from its hot wallets across more than 10 blockchains.

The breach highlights how access to people and internal systems can combine into a path to funds. “It was not a single isolated breach or a simple phishing incident,” Binance wrote in a security update. The company says it has set aside funds to cover losses and has rebuilt or replaced internal systems affected by the attack. It apologized for the concern and disruption caused to users, partners and the wider industry.

A chain of access, from June to October

Binance traces the first related activity to June, when an engineer it calls Engineer A downloaded what the company describes as a tampered Homebrew installation found through an online search. Binance says its security team detected and addressed that incident, but details about the employee were later exposed to the attackers.

In early September, another engineer, Engineer B, was approached through a job-hunting platform and invited to a video interview. The purported recruiter used convincing social media accounts and personal photos. After a second interview over online chat, the engineer was asked to download an assignment to a work computer. Binance says the assignment contained a malicious code repository.

The company describes malware designed to conceal its behavior. It allegedly replaced part of a legitimate development tool with a malicious version, allowing the attackers to run commands and communicate with a server they controlled. Binance says the intruders also took steps to hide their activity.

More than a week before the theft, the attackers used access to Engineer B’s machine to gain control over the wallet associated with Engineer A and another wallet software engineer, identified as Engineer C. On October 29, they logged into a staff member’s computer using stolen credentials. Binance says they then exploited unauthorized access to an internal signing service to initiate transactions outside the normal withdrawal process.

The update presents this sequence as the result of months of preparation, rather than a direct theft of a wallet key. Sophos threat intelligence director Rafe Pilling said the account fits the methods associated with TraderTraitor, a sophisticated group previously linked to a separate theft of more than $1.5 billion. “The attackers didn’t simply steal a wallet key,” Pilling said. “They compromised engineers, used that access to understand and move through the environment, and ultimately subverted the systems used to authorize transactions.”

Attribution and the money trail

Binance has not directly attributed the breach to TraderTraitor. It points to the FBI’s attribution to North Korea and says its own team had previously detected suspected North Korea-linked activity. The company reports that it detected and prevented 57 suspected cases linked to North Korea during 2026. Cryptocurrency tracing firms also attributed the theft to North Korean hackers soon after the funds began moving. The FBI linked TraderTraitor to the Binance attack on October 31.

Binance says more than $6 billion was stolen, but parts of the cryptocurrency industry froze almost half of the funds where that was possible. Those assets are inaccessible to the attackers, while billions remain under their control. Turning stolen cryptocurrency into cash can take months, and the process may be interrupted when assets are frozen or exchanges block transactions.

The movement of funds has been unusually broad. Elliptic cofounder and chief scientist Tom Robinson reported that, during the first three and a half days, laundering activity used about 12,000 wallets across 11 blockchains, with more than 40,000 transactions. That works out to roughly one new wallet every 25 seconds. Robinson described the activity as highly complex and likely automated.

The scale fits a wider pattern of cryptocurrency theft attributed to North Korean hackers. TRM Labs estimates that they have stolen around $12 billion in cryptocurrency since the start of 2017, with more than half of that total coming from heists this year. The amount that ultimately reaches North Korea remains unclear: some assets can be frozen, and some transfers can be blocked by exchanges.

What the incident shows about wallet security

Pilling’s assessment points to the operational weakness at the center of the breach: once attackers gained a foothold through engineers’ computers, they had time to learn how Binance’s systems worked and how transactions were authorized. “The initial compromise is just a foothold,” he said. “The real attack is carefully engineered around how the victim actually moves money.” The account suggests that protecting signing services requires attention to the identities and devices that can reach them, as well as to the transaction controls themselves.

The reported speed of the final theft contrasts with the drawn-out intrusion that preceded it. Binance says the actual attack unfolded in about 20 minutes, but the access used to carry it out accumulated over months. The company calls its findings an initial stage of the investigation, leaving open how the attackers coordinated their access and how much of the remaining cryptocurrency can be recovered.

Tracing and freezing efforts will shape what happens to the stolen funds next. A report from the Multilateral Sanctions Monitoring Team says successfully laundered proceeds may support North Korea’s nuclear weapons and ballistic missile programs. It describes reliance on underground banking and facilitators based in China, as well as intermediaries elsewhere. For exchanges and wallet operators, the immediate lesson is practical: a signing system can be reached through a chain of seemingly ordinary software and recruitment interactions, so controls around staff devices and transaction authorization matter as much as custody of the wallet itself.

Sources: WIRED on North Korean cryptocurrency theft; WIRED on a prior crypto heist; WIRED on the Binance theft; Binance’s security update; analysis of frozen funds; Financial Times on laundering timelines; FBI alert on the prior theft; FBI alert on the Binance attack; TRM Labs analysis; Elliptic’s analysis; Multilateral Sanctions Monitoring Team report.