Binance hack: what we know about the $6.3 billion theft
By Jorge Graells · October 30, 2026 at 7:31 AM UTC · 10 min read
Updated:
Binance suffered a theft of about $6.3 billion on October 29, the largest in crypto history. The FBI attributes it to North Korean hackers and, according to Binance, it all began with a fake job interview targeting an engineer. The company says it will absorb the losses and has reopened withdrawals.
Binance hack: what we know about the $6.3 billion theft
- Type
- News
- Author
- Jorge Graells
- Date
- Updated
- Reading time
- 10 min read
- Subjects
Summary
Binance suffered a theft of about $6.3 billion on October 29, the largest in crypto history. The FBI attributes it to North Korean hackers and, according to Binance, it all began with a fake job interview targeting an engineer. The company says it will absorb the losses and has reopened withdrawals.
On Thursday, October 29, Binance, the world's largest cryptocurrency exchange, suffered a theft that the company itself estimates at around $6.3 billion. If the figure holds, it's the biggest theft in crypto history: four times the 2025 Bybit hack, which held the record until now. Here's what we know, based on Binance's statement1 and reporting by NBC News2, and what it means for anyone with money there and for any company.
Updated November 5. Binance has published its incident report3: it all began in September with a fake job interview targeting an engineer. The FBI attributes the theft to North Korean government hackers in an official alert4. Binance has published the proof of reserves it promised and says it has already covered about 95% of what was stolen, according to its fifth update5. Withdrawals reopened on November 1 and about $3.64 billion left on a net basis in the first hours, around 2% of what the platform holds, according to CNBC6. On November 3 it reopened withdrawals for 51 more tokens, according to crypto.news7, and it has taken out about half the bitcoin in its emergency fund, according to Cointelegraph8. Details below, in each section. Binance has commissioned an independent review, and I'll update this story if more details come out.
◢What happened
The incident report3 Binance published on November 3 describes an attack prepared over weeks. In September, a software engineer was contacted on a legitimate job-hunting platform by someone posing as a project director at a fictitious company. After a video call with a supposed HR representative and a second interview, on a messaging app, with someone claiming to be the CEO, the engineer was told to download an assignment containing a malicious code repository onto their work computer. Running it installed malware that, according to Binance, the machine's endpoint protection tools did not detect.
On October 20, the attackers used that computer and an internal AI tool to take control of the machines of two other engineers working on the wallets, and found that one of them had a token with permission to deploy containers. On October 29, between 17:15 and 19:56 UTC, they got into one of those computers, used the stolen credentials, deployed a container and launched the script that started the theft. The last unauthorized transfer, of ether, was finalized at 23:56 UTC.
In its first statement, Binance said it had found no evidence that its wallets' private keys were leaked. So they didn't steal the keys to the vault, they posed as one of the systems allowed to move the money.
In its second update9, Binance says its hot wallets, the ones connected to the internet for day-to-day operations, were compromised at around 20:05 UTC on October 29. Those early statements mentioned a DevOps engineer's laptop and other unspecified ways in. The report now lays out the route, although it warns that some technical details will remain confidential and that it has commissioned a review by outside experts.
Binance says it has rebuilt the affected wallet system and the internal AI tool, replaced the compromised devices and decommissioned the credentials of the engineers involved.
◢Who's behind it? The FBI points to North Korea
On October 31, the FBI published an alert4 stating that North Korea is responsible for the theft of more than $6 billion in crypto from Binance. It calls this activity "TraderTraitor", the same name it uses for the North Korean hackers who robbed DMM Bitcoin and Bybit.
According to the alert, the FBI, the Secret Service and the IRS criminal investigation unit (IRS-CI) have seen the attackers convert the stolen funds mainly into ether, and expect them to keep laundering it through DeFi and instant swap services. So they're asking exchanges, DeFi platforms, node operators and blockchain analytics firms to block any transaction coming from the attackers' addresses. The alert publishes the full list: hundreds of Ethereum, bitcoin and Solana addresses.
The Secret Service says that, together with the industry and the Department of Justice, it froze a significant share of the funds within minutes, according to The Record10.
North Korea denies responsibility, according to The Record11. The same outlet reports Binance as saying it has caught and stopped 57 attempts by North Korean actors this year to break into the company or compromise its employees.
◢How much money, and what's been recovered
Binance estimates the total impact at around $6.3 billion and warns the figure may change as it traces the funds. With help from blockchain analytics firms, it had frozen about $3 billion according to its early statements. Its November 3 report3 lowers that to about $2.85 billion frozen or intercepted, and warns the figure is still subject to reconciliation and market prices.
To cover the gap, Binance says in its second update9 that it has already set aside more than $6.34 billion of its own funds, $5 billion of it in the same tokens that were stolen (USDC, USDT, bitcoin, ether, BNB...). That covered about 80% of the impact. It's buying the rest on the market and through OTC deals, meaning directly with large sellers. In its fifth update5, on November 2, it says it has now covered about 95%. What's left are less liquid tokens, which take longer to source in that volume. The report gives another figure, measured differently: 98% of the impacted tokens replenished as of October 31.
Other companies have blocked part of the money too. According to NBC News, Tether, the issuer of the USDT stablecoin, froze more than $1.567 billion, according to its CEO Paolo Ardoino, and Circle, the issuer of USDC, froze "hundreds of millions", according to its CEO Jeremy Allaire.
The news moved the market: on Thursday bitcoin fell about 4.3% and ether 4.6%, according to NBC News2.
◢Is my money safe on Binance?
Binance says user funds are safe and that it will cover all losses from its SAFU emergency fund and the company's own funds. Its founder, Changpeng Zhao, wrote that as a shareholder he expects all user funds to be fully covered.
Withdrawals came back on Sunday, November 1, in phases. According to its fourth update12, Binance started with the networks and coins users had requested most in the previous week, and its official account has been announcing each one as it's re-enabled: first bitcoin, ether, BNB Chain, XRP and Base, then over the morning others such as Solana, Arbitrum, Tron, Polygon and Avalanche. It warns there may be delays and that if a withdrawal doesn't go through, you can try again a little later. Deposits stayed open the whole time. On November 2 it published the proof of reserves5 for the snapshot it took on October 31. Anyone holding bitcoin, ether, USDT, BNB, Solana, USDC, XRP or one of the other three tokens covered can check with the verification tool on its website that their balance is backed at least 1:1. That shows those balances were covered on that date, but it isn't a full financial audit and it doesn't mean the stolen funds have come back, as NewsBTC13 explains. Binance planned another snapshot for November 4 with more tokens, and the proof takes 40 to 50 hours to generate, according to Cointelegraph8, so the result isn't expected before the 6th.
On November 3, at 04:00 UTC, Binance reopened withdrawals for 51 more tokens, 31 on Ethereum and 20 on Solana, and it still hasn't given a date for the rest, according to crypto.news7.
It has also drawn on its emergency fund to pay for all this. Binance confirmed it took 7,499 bitcoin out of SAFU, which is left with about 7,500, close to half of what it held, according to Cointelegraph8. It has promised to bring the fund back to about $1 billion, according to crypto.news7, but there's no timeline.
In the first nine and a half hours of withdrawals, users took out $4.65 billion and deposited $1.01 billion, a net outflow of $3.64 billion, or 2.1% of the $171 billion Binance holds, according to CNBC6. Founder Changpeng Zhao summed it up as "98% choose to stay!". It isn't a bank run, but it's a very large number for so few hours. Circle, the company behind USDC, has now frozen more than $1.1 billion of the stolen funds together with law enforcement, according to the same outlet.
Binance has also revoked the affected address's authorization and is working with law enforcement to trace the funds.
◢What to do now if you have an account
The most immediate risk for an ordinary user isn't the theft itself, it's what comes after. Every time a well-known company makes the news for an attack, scammers show up to exploit the fear: emails and texts claiming to be from Binance asking you to "verify your account", "claim your compensation" or "move your funds to a safe wallet". Binance itself warns14 that scammers may impersonate it through direct messages, emails, group chats and even small transfers with a message attached.
- ▹Don't click links in emails, texts or messages claiming to be from Binance. Open the app or type the website yourself.
- ▹Never share your password, verification codes or a wallet's recovery phrase. No legitimate support team will ask for them.
- ▹Be wary of anyone offering to recover money, advance you compensation or help you withdraw funds before everyone else.
- ▹Now that withdrawals are reopening, ignore anyone rushing you to take your money out "before they close again" or sending you a link to do it. If you want to withdraw, do it from the app, and check there whether your network is available yet.
- ▹If you want a refresher on spotting a fake email, I covered it in how to spot a phishing email.
◢A fake interview as the way in
What interests me most about this story isn't the number, it's how they got in. According to its own report, one of the companies with the biggest security budgets in the world didn't fall because of a flaw in its vaults, but because an engineer ran a fake interview's technical test on a work computer. From there, using an internal AI tool, the attackers reached the people who did hold the keys.
It isn't a one-off. In 2024, according to the FBI15, North Korean hackers posed as recruiters on LinkedIn and sent an employee at Ginco, a Japanese crypto wallet software company, a supposed technical test for a job. It was a malicious script. With that compromised computer, they ended up stealing $308 million from DMM Bitcoin. The FBI also attributed16 the $1.5 billion Bybit theft in 2025 to North Korea. Now the FBI puts the Binance theft on the same list. The pattern is familiar: the target is the people who hold the keys. I've written separately about how to avoid a fake job interview with malware, with the warning signs and the rules any company can set.
◢What any company should learn
You don't need to move billions for this to apply to you. If someone on your team has access to online banking, servers or admin accounts, their laptop is a way in.
- ▹Devices with privileged access shouldn't be used for anything else: not for testing strangers' code, not for opening files from hiring processes.
- ▹Two-factor authentication everywhere, minimum permissions, and regular reviews of who can do what.
- ▹Watch for unusual operations: an out-of-the-ordinary withdrawal or payment should raise an alarm before it completes, not after.
- ▹Train the people who hold those keys to recognize social engineering, including fake job offers.
That's exactly what I work on in my cybersecurity training for companies: making sure the person with access to what matters knows they're a target and how they get attacked.
Related documents
- News
Crédit Mutuel Arkéa cyberattack: attackers came in through a vendor
French bank Crédit Mutuel Arkéa suffered an attack that allowed fraudulent transfers from its own account. The attackers got in through a service provider's platform. What we know, what we don't and what to learn.
- Article
Device code phishing: what it is and how to stop it
Device code phishing tricks the victim into typing a code generated by the attacker into Microsoft’s real sign-in page. That gives the attacker access to their Microsoft 365 account without a password and without two-step verification getting in the way. Blocking that sign-in flow stops it.
- News
Claude Code leaks keys on GitHub: the settings.local.json problem
Claude Code's "don't ask again" option can save passwords and API keys in .claude/settings.local.json. Apiiro found 1,122 public copies on GitHub with secrets inside. What we know and what to do.