The attack, according to Binance’s account, began well before the money moved. In June, hackers were already probing the wallet team; in September, someone posing as a project director contacted a software engineer through a job platform.¹

The recruitment pitch was built to look real. After two interviews — including a video call with a purported HR representative — the engineer downloaded an “assignment” to a work computer. It carried malicious code that Binance’s security tools did not detect.¹ The company later said, bluntly, “This should not have happened.”¹

On Oct. 20, the attackers used that compromised machine and an internal Binance AI tool to seize control of two wallet-team engineers’ computers. One engineer could deploy software. Nine days later, the intruders used that access to reach a transaction-signing service and drained hot wallets — funds kept available for fast withdrawals — over nearly four hours.¹

Binance’s more detailed account says simply halting withdrawals could not immediately stop the theft: the attackers had acquired partial control of an Ethereum account, where access was recorded on the blockchain rather than solely inside Binance’s systems. Engineers had to devise a workaround because the account’s distributed security setup made quick revocation difficult.²

The FBI said Saturday that TraderTraitor, a North Korean hacking unit, carried out the attack. North Korea denied the allegation. Binance says it blocked 57 other suspected North Korean hacking attempts this year, framing the breach as part of sustained pressure rather than an isolated failure.¹

The exchange says roughly $2.85 billion has been frozen or intercepted, customers will be made whole, and 98% of affected tokens have been replenished. It has rebuilt the compromised systems, replaced affected computers and plans an outside security review — a costly test of whether its fix can match the patience of its attackers.²