Binance says the route to the largest known crypto theft began not with a dramatic breach, but with patient deception. In June, one wallet-infrastructure employee installed a tampered software package while setting up an AI coding tool; the exchange says it replaced the device and rotated credentials, but the wider team had already been exposed.¹

By September, attackers had moved to a second target: a software engineer approached through a legitimate job platform by a supposed project director. The operation included two interviews, a live video call and social-media material designed to establish credibility before the candidate was asked to download an “assignment.” Binance called the tactic “more advanced and deceptive than previously seen social engineering approaches.”¹

On Oct. 20, according to Binance’s account, the attackers used the compromised machine and an internal AI tool to take over two wallet-team computers, including one belonging to an engineer able to deploy software.² Nine days later, that access reached a transaction-signing service and the exchange’s hot wallets. Binance’s detailed breakdown says five XRP-wallet transfers alone moved 233.46 million XRP between 20:05 and 20:09 UTC; it described the overall theft as a four-minute operation.¹

The exchange’s account underscores a troubling distinction: stopping withdrawals was not enough once attackers had gained control embedded in an Ethereum account’s permissions. Binance said engineers had to devise a workaround because the account’s distributed controls could not be quickly revoked.³

On Oct. 31, the FBI identified the alleged culprit as TraderTraitor, a North Korean hacking unit. Binance says it has blocked 57 other suspected North Korea-linked attempts this year and accepts responsibility: “This should not have happened.”²

North Korea, however, has flatly rejected the attribution. Kim Yo Jong called the FBI’s allegation “absurd rhetoric” and said portraying the country as responsible for cybercrime around the world was “a grave political provocation.”¹ Binance says it will cover customer losses and that roughly $2.85 billion has been frozen or intercepted.³