The operation, Binance says, began quietly in June, when attackers started probing its wallet team and one engineer downloaded a tampered version of a widely used software tool. The exchange says the campaign was more elaborate than earlier attempts it had faced, built around social engineering rather than a blunt assault on its systems.¹

By September, the attackers had allegedly posed as a project director on a recruiting platform and lured a Binance software engineer through two interviews, including a video call with a supposed HR representative. The final “assignment” downloaded to the employee’s work computer contained malicious code that Binance’s security tools failed to detect.¹

On October 20 — nine days before the theft — Binance says the compromised machine and an internal AI tool were used to take control of two wallet-team engineers’ computers. One had software-deployment privileges. Attackers then reached a transaction-signing service and, over nearly four hours, began draining the exchange’s hot wallets. “This should not have happened,” Binance said.¹

The breach did not end when withdrawals stopped. Binance says the attackers gained partial control of an Ethereum account through compromised systems; because that authority was recorded on the blockchain rather than solely inside Binance, revoking it quickly proved difficult. Engineers had to devise a workaround while funds continued moving through roughly 12,000 wallets, according to Elliptic.¹

The FBI said Saturday that North Korean hacking group TraderTraitor carried out the attack, an allegation Pyongyang denies. Binance says it had already intercepted 57 other suspected North Korean attempts this year.¹

Binance says $2.85 billion has been frozen or intercepted, 98% of affected tokens have been replenished, and customers will be made whole. It has rebuilt compromised systems, replaced affected computers and plans an outside security review — remedies that come after a failure it now concedes should never have occurred.¹