Binance says fake interviews helped hackers reach its crypto wallets

The FBI said on 31 October that North Korea was responsible for stealing more than $6 billion in virtual assets from Binance. It calls the cyber activity behind the attack TraderTraitor.

Binance said its internet-connected wallets were compromised on 29 October and estimated the tokens taken at around $6.3 billion. Blockchain analysis firm Elliptic put the figure at $6.43 billion, more than four times its estimate for the 2025 Bybit hack. It considers the Binance attack the largest known cryptocurrency theft. Neither estimate represents the final net loss.

The FBI said it, the US Secret Service and the IRS criminal investigation division had observed the stolen assets being converted mainly into ether. The agencies asked cryptocurrency businesses to block transactions linked to addresses listed in the FBI alert.

The bureau did not set out its full evidence for identifying the attackers. Chainalysis said it had traced Binance funds being mixed with proceeds from a previous theft at Bitget, which had also been attributed to North Korean actors. Elliptic initially cautioned that the overlap involved only a small portion of the Binance funds and was not conclusive; it later said the connection had grown. TRM Labs separately attributed the attack to TraderTraitor with high confidence, citing information from both on and off the blockchain.

US President Donald Trump said on 31 October that it was not yet certain whether North Korea was involved, Reuters reported. Pyongyang has long denied using state-linked cyber units for theft and revenue. North Korean representatives did not respond to Reuters’ requests for comment on this case.

Binance said on 30 October that it and its partners had frozen about $3 billion in affected assets. Freezing funds can prevent them being moved, but does not mean they have been returned. The exchange later said it had covered about 95% of the affected amount using company resources and funds including insurance reserves. That figure describes replacement assets, not the proportion recovered from the attackers or paid to customers.

After temporarily suspending withdrawals, Binance said it would restore them in phases. Reuters reported that bitcoin withdrawals resumed on 1 November; other assets and networks were to follow.

Binance initially said a compromised employee laptop might have been involved, but subsequently reported finding additional points of breach. Its investigation into the full sequence of the attack continues.

Update

In its initial report on the 29 October attack, the cryptocurrency exchange said an engineer was approached in September through a legitimate job-hunting platform about a role at a fictitious company.