Binance has finally explained how thieves stole about $6.3 billion from its wallets on 29 October, in what is described as the largest cryptocurrency theft on record. In an incident report published on 3 November, the world’s biggest crypto exchange describes a five-month campaign built on patience, fake identities and ordinary human trust: a tampered software installer in June, a bogus job interview in September, and a coding test that carried malicious code.
The report changes the shape of the story. When the theft was first disclosed, its sheer size suggested a deep technical break-in. Binance’s own account says the opposite: the attackers never broke the cryptography. They talked their way in, one engineer at a time, until they held the keys to the exchange’s hot wallets — the internet-connected wallets that process customer withdrawals. The FBI has since attributed the theft to TraderTraitor, a North Korean state-backed hacking group linked to the Lazarus group. Pyongyang has denied any involvement.
June: A Tampered Installer Opened the First Door
The campaign began quietly, in June 2026. An engineer on Binance’s wallet DevOps team — the group that looks after the systems holding customer funds — was setting up a popular AI coding tool and downloaded a tampered installer from an online advertisement, rather than from the company’s usual channel. The installer was a doctored version of Homebrew, a package manager widely used on Mac computers.
Binance says it caught that intrusion. The computer was replaced, the credentials were changed, and the incident appeared to be closed. But the attackers had already taken something valuable from it: they had learned who worked on Binance’s wallet systems. The first break-in had failed as a theft, but it had succeeded as reconnaissance. Binance says it detected and blocked 57 hacking attempts linked to North Korea during 2026 before this one got through.
September: The Fake Job Interview That Took Over a Laptop
The approach that worked arrived in September, dressed as an opportunity. A software engineer at Binance — identified in the report only as Engineer B — was contacted through a legitimate job-hunting platform by a person posing as a project director. His public profile mentioned his experience at Binance, which is how the attackers appear to have chosen him.
What followed was a careful piece of theatre. Engineer B was given a first-round interview with someone playing a human-resources representative, and then a second round with a person claiming to be the chief executive of a company that does not exist. Then came the coding assignment: Engineer B was asked to download a repository of code onto his work Mac and run it as part of the technical assessment.
The code hid malware. When it ran during setup, it replaced a legitimate developer tool — pyenv, a tool for managing Python versions — with a malicious copy that connected to the attackers’ server and covered its tracks. Binance’s endpoint security software did not catch it straight away. One engineer, looking for a better job, had handed the attackers control of his laptop.
20 to 29 October: From One Laptop to $6.3 Billion
For almost a month, the attackers moved carefully. On 20 October, they used Engineer B’s compromised computer — and an internal Binance AI tool — to take over the machines of two more engineers on the wallet team: the DevOps engineer first targeted in June, and a wallet software engineer. One hacked machine had become three.
That was the decisive step. The DevOps engineer’s computer held a token that gave permission to deploy containers — packaged pieces of software — on Binance’s systems. On 29 October, between 17:15 and 19:56 UTC, the attackers used one engineer’s credentials on another engineer’s machine to deploy a container and run a script that reached the exchange’s internal wallet signing service, letting them approve transfers outside the normal withdrawal process.
About $6.3 billion in digital assets then left Binance’s hot wallets across ten blockchains, most of it in a burst lasting only about twenty minutes. The haul included roughly 18,270 bitcoin, more than 200,000 ether, and billions of dollars in the stablecoins USDT and USDC. Because the hot wallets use multi-party computation, no single key could be revoked to stop it. The theft was contained only around 00:10 UTC on 30 October.
Who Did It, and What Happens Next
The FBI said on 31 October that North Korea was responsible for the theft of more than $6 billion in virtual assets from Binance, naming the TraderTraitor group. Blockchain analytics firms TRM Labs and Chainalysis reached the same conclusion with high confidence, and TraderTraitor is the same group blamed for the roughly $1.5 billion Bybit theft in February 2025. North Korean operatives have long posed as jobseekers and recruiters to steal money for the regime’s weapons programmes, and American intelligence assesses that Pyongyang nets at least $1 billion a year from cryptocurrency theft and other financial crime.
For customers, the practical news is better than the headlines suggest. Binance set aside more than $6.34 billion from its corporate treasury, its Secure Asset Fund for Users and its futures insurance fund to cover the loss, and says it has now replaced about 98 percent of the affected assets. Between $2.5 billion and $2.85 billion of the stolen funds have been frozen or intercepted, after the stablecoin issuers Tether and Circle froze stolen tokens. Withdrawals were paused for about 48 hours and resumed in phases from 1 November, and customers pulled a net $3.64 billion on the first day — about 2.1 percent of the exchange’s assets. Binance has apologised, saying the incident “should not have happened”.
For the rest of the industry, the lesson is uncomfortable. The weakest point was not cryptography. It was a handful of engineers, their laptops, and the permissions those machines held. Security experts say the defences are straightforward: treat any coding assignment from a recruiter as untrusted code and run it only in a disposable virtual machine, restrict what can be downloaded on work machines, and keep powerful credentials such as deployment tokens off developers’ laptops. Until approvals for moving funds require independent, hardware-backed sign-off, the same route will stay open to anyone with patience and a convincing fake company.
Sources: CoinDesk — Binance arranges $6.34 billion to cover losses from biggest crypto hack ever; ReversingLabs — Binance heist: a fake interview, a trojanized pyenv, and what RL sees; Binance Square — Binance incident report breakdown
Related Posts
TechnologyXGIMI AURA 3 Smashes Kickstarter Record — $10 Million in 2 Hours for the 4K 120Hz Laser TV
TechnologyJETOUR T1 i-DM Deliveries Begin in Pakistan This November: Price, Specs and Booking Details
TechnologyAsus Zenbook 14 (2026) Launched in India With Intel, AMD and Snapdragon Chips, 33-Hour Battery Life and Prices From Rs 1,36,990
TechnologyTeleAI Privacy Camera Detects Danger Without Recording a Single Frame of Video
TechnologyAina AI Ring Unveiled: The Ring That Knows What You Need Before You Ask
TechnologyEZVIZ 11.11 Sale in Pakistan: Up to 60% Off Smart Security Cameras — Dates, Deals and Where to BuyMost Popular
How-ToPTA Tax Calculator 2026: Check Mobile Tax on Any Phone417 views
Pakistan NewsPIA Boeing 787 Lease Deal: What It Means for the Airline389 views
Canada JobsTech Jobs in Canada: Roles, Salaries, and Skills Needed387 views
SportsUEFA Champions League 2026-27: Format, Teams and Schedule384 views
TechnologyPM Shehbaz Sets November Deadline for Alibaba AI and Digitalisation Projects in Pakistan364 views
ShowbizWomen’s Fashion in Pakistan 2026: Trends, Brands and Style Guide360 views
One comment