Binance says it blocked 57 suspected North Korea-linked cyber threats in 2026 and has replaced 98% of the tokens stolen in its $6.34 billion hack.
Summary
- Binance detected recruitment scams, malicious developer tools and fake video conferencing apps among suspected threats.
- Yi He acknowledged the severe cost of the attack that bypassed the exchange’s defenses.
- The exchange says it is still purchasing less liquid tokens to complete asset replenishment.
- US investigators have attributed the Oct. 29 theft to North Korea’s TraderTraitor activity.
Binance co-founder and co-CEO Yi He outlined the attempted intrusions in a Nov. 3 post on X, sharing the exchange’s findings on the Oct. 29 security breach.
Her account described repeated efforts to reach employees through recruitment, software downloads, and social engineering. The techniques included fraudulent job interviews, compromised software packages and browser extensions, and malicious programs presented as popular developer tools.
Fake video conferencing applications were another route, alongside campaigns designed to steal credentials or install malware that gives attackers remote access to a computer.
“We intercepted many of them, but the cost of failing to stop even one was severe—and this should never have happened,” Yi wrote.
Binance describes how a fake interview reached an employee
According to Binance’s initial findings, a software engineer was approached in September through a legitimate job-hunting platform by someone posing as a project director.
A supposed human resources representative conducted a video interview and shared a social media profile containing personal photos and videos. A second interviewer, presented as the chief executive of a fictitious company, instructed the engineer to download an assignment onto a work computer.
Binance said the assignment contained malicious code that ran during setup and escaped detection by the endpoint security tools in use.
On Oct. 20, the attacker used the compromised computer and an internal AI tool to reach two wallet engineers. Credentials obtained during that intrusion subsequently enabled access to wallet signing operations.
The exchange’s account describes several stages of intrusion, although Yi’s post does not break down how many of the 57 suspected cases involved recruitment lures.
Earlier wallet authorization findings traced part of the theft to Binance 14, an Ethereum hot wallet. Blockaid identified 50 submitted EIP-7702 authorizations, one of which successfully delegated execution rights to a malicious contract.
Binance reports 98% replenishment as token purchases continue
In its Nov. 3 report, Binance said 98% of the impacted token assets had been replenished and that it was buying the remaining, less liquid assets. The company said it had set aside more than the funds required to cover the loss.
As crypto.news previously reported, Binance reopened Bitcoin withdrawals on Nov. 1, when Richard Teng put replenishment at approximately 95%.
The exchange had identified BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC as fully backed. Its recovery notice said the outstanding tokens outside that group took longer to purchase in the quantities required.
Replacement purchases have drawn on the Secure Asset Fund for Users, excess reserves from the Futures Insurance Fund and Binance’s corporate treasury, according to its earlier recovery disclosures.
Withdrawal access has continued returning through individual assets and networks. On Nov. 3, Binance restored more withdrawals for 31 additional assets on Ethereum and 20 on Solana, following the reopening of five Ethereum stablecoins.
US investigators identify TraderTraitor activity
The FBI’s Oct. 31 cyber alert attributed the theft to North Korea and identified the activity as TraderTraitor.
Working with the US Secret Service and IRS Criminal Investigation, the bureau observed attackers converting stolen assets primarily into Ether. It said further laundering through decentralized finance and instant swap services was expected.
The agencies urged exchanges, blockchain analytics firms, DeFi services and infrastructure operators to block transactions involving the listed addresses or assets derived from them.
North Korea denied involvement on Nov. 3. According to the Associated Press, Kim Yo Jong rejected the FBI’s accusation in a statement carried by state media.
Stolen funds enter CoinJoin transactions
Separate tracing work has documented the movement of stolen assets while Binance purchases replacements.
Elliptic identified approximately 28 BTC, worth $2.2 million, entering 18 CoinJoin transactions between Nov. 1 and early Nov. 2. The Bitcoin came from converted stolen assets, while the 18,270 BTC taken directly from Binance remained in 19 addresses at that assessment.
The firm’s investigation covered roughly 12,000 wallets, 11 blockchains, and more than 40,000 transactions. Theft-linked addresses still held an estimated $3.24 billion, mainly in Ethereum and Bitcoin.
