The operation, Binance says, began with quiet probing in June, when attackers targeted its wallet team and an engineer downloaded a tampered version of a popular software tool. The later recruitment ruse was built for credibility: a supposed project director approached a software engineer through a job platform in September, followed by two interviews, including a video call with a fake HR representative. The final “assignment” carried malware that Binance’s security systems did not catch.¹

On Oct. 20, the attackers used that compromised computer and an internal Binance AI tool to seize control of two wallet-team engineers’ work machines. One engineer had authority to deploy software. Nine days later, that access opened a transaction-signing service; the attackers then drained hot wallets—funds kept ready for customer withdrawals—over nearly four hours. Binance’s blunt assessment: “This should not have happened.”¹

The exchange says halting withdrawals alone could not stop the theft because the attackers had gained partial control of a Binance account on Ethereum, where that access was recorded outside Binance’s own systems. With control distributed across several systems, engineers had to devise a workaround rather than simply revoke access.²

The breach eclipsed the previous crypto-theft record, roughly $1.5 billion taken from Bybit in February 2025. The FBI has attributed the Binance attack to TraderTraitor, a North Korean hacking unit; North Korea denies the allegation. Binance says it has blocked 57 other suspected North Korean attempts this year.¹

Binance says about $2.85 billion has been frozen or intercepted, 98% of affected tokens have been replenished, and customers will be made whole. It has rebuilt the compromised systems, replaced affected computers and plans an external security review—remedies that address the aftermath, not the central embarrassment: a fake hiring process reached the heart of the world’s largest exchange.²