TLDR
- Binance says the attack began in June with a poisoned coding tool and led to a $6.34 billion theft on October 29.
- A fake job interview helped hackers infect a second engineer’s computer in September.
- The FBI links the attack to North Korea’s TraderTraitor group, which was also tied to the Bybit theft.
- Binance says about $2.85 billion has been frozen or intercepted, and 98% of affected assets have been replaced.
- A Singapore legal letter says investors’ protection depends on where their crypto is held.
Binance says the largest crypto theft on record began months before any coins moved. The exchange lost about $6.34 billion on October 29, more than four times the $1.5 billion taken from Bybit in February 2025.
📊 Traders are still feeling the aftershock of Binance’s $6.34B hack. We break down many metrics & indicators you won’t find elsewhere making huge anomalies, such as historic BTC FUD levels, ENA active withdrawals ballooning, and outflows galore! 👇https://t.co/8MjryPILJh pic.twitter.com/EDA64sgOOM
— Santiment Intelligence (@SantimentData) November 6, 2026
A Fake Job Interview Opened the Door
Binance’s November 3 report traces the plot to June. An employee working on wallet systems downloaded a tainted Homebrew installation while looking for an AI coding tool.
The security team caught the problem, replaced the computer and reset the credentials. By then, the attackers had learned who ran the wallet systems.
In September, they contacted a second engineer through a job-search site. Posing as recruiters, they held interviews and then sent a coding assignment that carried malware.
That infection went unseen. On October 20, the attackers used the computer and an internal AI tool to reach two more engineers, one of whom could approve software deployments.
Nine days later, they added malicious code to an internal wallet-signing service. The FBI links the attack to North Korea’s TraderTraitor group.
Binance says it stopped 57 suspected North Korean attack attempts in 2026. Despite that, this campaign got through.
Four Hours of Theft and a Slow Recovery
The theft began around 20:05 UTC. In the first four minutes, five wallets sent out about 233.46 million XRP, while others moved 970,500 SOL and about 18,270 BTC.
On Ethereum, the attackers used a feature called EIP-7702 to give a malicious contract control of a wallet. Binance’s shared signing setup, which stops one person from acting alone, made removing that control harder.
The last transfer finished at 23:56 UTC. Binance cleared the wallet’s permissions shortly after midnight.
Tether and Circle froze large amounts of stablecoins quickly. By November 3, Binance said about $2.85 billion, or nearly 45% of the total, had been frozen or intercepted.
An attacker also put $60 million of USDT into Aave and borrowed 19,762 wrapped ETH, worth about $44.6 million. Aave said the loan stayed backed by more collateral than was borrowed.
Binance paused withdrawals and said users would not bear the losses. It used its Secure Asset Fund for Users to replace about 90% of affected assets by October 31, and the figure later reached 98%.
Withdrawals reopened in stages from November 1 through November 5. Bitcoin briefly rose above $80,000 on November 4, then fell back toward the mid-$75,000 range.
A letter published Monday by The Business Times notes that Binance is not licensed in Singapore and that its terms fall under Abu Dhabi Global Market law. In Quoine v B2C2, Singapore’s Court of Appeal found that keeping customer assets apart from an exchange’s own was not enough, by itself, to create a trust.
After the 2024 WazirX hack, users recovered about 85.5% under a court-approved scheme. The letter advises checking a platform’s license, keeping long-term holdings in offline wallets and protecting email with an authenticator app.
