Binance’s $6.3B Hack Raises Security and Custody Stakes

Binance says hackers stole a record $6.3bn (£4.7bn) from its cryptocurrency wallets in a sophisticated, multi-stage attack involving social engineering, malware and a compromised internal AI tool. According to the company’s initial findings, an engineer was approached through a legitimate job-hunting platform and invited to fake interviews. The attackers built trust by sharing social media accounts containing personal images, then persuaded the engineer to download malware disguised as an interview assignment. The code used obfuscation techniques to avoid detection. Binance says the compromised computer and an internal AI tool were then used to access two other engineers’ laptops and carry out the attack. The incident prompted Binance to suspend customer withdrawals worldwide. After withdrawals resumed on Sunday, customers took out billions of dollars’ worth of assets. Binance apologised for the disruption and uncertainty, said it was working with law enforcement to trace and freeze affected assets, and reported that 98% of the impacted token assets had been replenished as of Saturday. The company said it had set aside funds exceeding the amount needed to cover the loss. US agencies, including the FBI and Secret Service, have helped investigate. The FBI and cyber analysts said the attack bore signs of North Korean involvement, though North Korea denied responsibility. Kim Yo Jong called the accusations an attempt to damage the country’s public image. Binance later cited information released by the FBI and said North Korea was responsible. The article notes that the TraderTraitor unit, also known as the Lazarus Group, was previously blamed for the 2025 Bybit hack. Binance plans to increase investment in AI-based threat detection, bring in outside cyber experts for a full review, establish a security research fund and work with AI and security firms.

North Korea has denied allegations that it carried out the record $6.3bn hack of cryptocurrency exchange Binance, describing the claims as “absurd rhetoric” and a US effort to damage the country’s image. Kim Yo Jong, a senior North Korean official and sister of leader Kim Jong Un, said the accusations were a political provocation and rejected the portrayal of cybercrime around the world as the work of the Democratic People’s Republic of Korea (DPRK). The FBI, the US Secret Service and cyber analysts have attributed the attack to North Korea. Blockchain analysts and the FBI say it was led by TraderTraitor, a state-backed hacking group also known as the Lazarus Group. The FBI has asked industry partners to help block transactions linked to the group. Pyongyang has been blamed for other major cyberattacks, including the 2025 theft of $1.5bn from crypto exchange Bybit, but has consistently denied involvement. Research groups say North Korea has developed its cyber operations by recruiting talented students and assigning them to units overseen by the country’s intelligence agency. Binance did not answer the BBC’s questions about North Korea’s alleged role. The company has focused its public comments on the breach and its response. It said net withdrawals since transactions resumed on Sunday totaled $4.72bn, a relatively limited share of its approximately $157bn in assets. Binance said withdrawals were stabilising at expected levels, and that initial checks suggested an engineer’s compromised laptop enabled unauthorised withdrawals. Trading in major cryptocurrencies has resumed after affected assets were frozen with issuers’ help. Binance says it will cover the losses and has already covered about 95% of the stolen assets.

The $6.3 billion Binance breach could change how investors assess cryptocurrency companies, shifting attention from trading activity and transaction fees toward custody, cybersecurity, compliance and operational resilience. The article distinguishes the incident from the collapse of FTX, describing it as a security breach rather than leadership-driven fraud. Binance acted to contain the damage and said it would use its own resources to cover losses. CEO Richard Teng told CNBC that the company had replenished 98% of the $6.34 billion in affected assets and was still purchasing the remaining, less-liquid assets. The response by Binance and other crypto firms helped prevent the breach from becoming a wider crisis of confidence. Tether, Circle and Ripple, among others, froze or restricted access to about $3 billion in stolen assets, while Coinbase blocked transfers to compromised wallets and offered Binance assistance. ClearStreet analyst Owen Lau said larger companies may have an advantage because they have more resources to invest in security and the controls needed to support infrastructure services such as tokenization. The breach may increase demand for specialized custodians and platforms with strong asset-protection capabilities, as institutional adoption depends on confidence in safely holding and transferring digital assets. Coinbase has had an institutional custody business since 2018; Circle entered the sector this year after receiving approval to operate as a trust bank. Ripple, Kraken, Gemini Space Station and BitGo are also identified as custody providers, with BitGo among the earliest institutional players. The article also points to possible industry consolidation as firms seek capabilities and scale. A further structural change could be separating custody from trading. Morgan Stanley analyst Felix Stratmann argues that repeated breaches may lead investors to keep assets with independent, potentially regulated custodians while continuing to trade on centralized exchanges. That arrangement could preserve exchanges as execution and liquidity venues while emphasizing asset segregation, resilience and investor protection.

Binance co-CEO Richard Teng said hackers spent months preparing a cyberattack that stole more than $6 billion in assets from the exchange on Oct. 29. He described a sequence of operations that began with a tampered developer tool in June and continued in September, when attackers posed as recruiters and used a job interview coding exercise containing hidden malware to compromise another engineer. Teng said the attackers then moved through Binance’s internal AI tools and gained access to the system authorizing wallet transactions. He rejected the idea that the breach resulted from a single point of failure involving one employee’s laptop. A Binance security report said the company detected suspicious activity after a Wallet DevOps engineer downloaded a modified Homebrew installation while searching for an AI coding tool. Binance replaced the engineer’s device and rotated credentials, but said the employee’s role and colleagues on the wallet infrastructure team had already been exposed. Teng acknowledged that the FBI has linked the attack to North Korean hackers associated with the TraderTraitor group, though he did not himself attribute the incident to them. Binance says it has replenished 98% of the $6.34 billion in affected assets and is still purchasing remaining, less liquid assets. The company temporarily restricted some withdrawals, pledged to cover customer losses and used its reserves to restore assets. Binance and industry partners, including Tether, Circle and Ripple, reportedly froze about $3 billion; Coinbase also blocked transfers to compromised wallets and offered assistance. Some stolen funds continue to move through laundering channels. Teng said Binance has rebuilt the affected wallet system and internal AI tool, replaced compromised devices, decommissioned associated credentials and tokens, and expanded security scans. The company is also engaging an independent expert and working with law enforcement and industry partners to trace and freeze funds. The breach briefly damaged confidence in crypto markets, and investors are watching whether Binance can restore faith in centralized exchanges.

North Korea denied responsibility for the estimated $6.3 billion Binance hack, with Kim Yo Jong calling the FBI’s attribution of the attack to North Korea-linked group TraderTraitor a “grave political provocation.” She accused Washington of trying to portray North Korea as a cybercriminal state and of misleading international opinion. The denial came as blockchain analytics firms Elliptic and Chainalysis continued tracing the stolen cryptocurrency and linked the activity to North Korea-associated actors. Elliptic reported that during the first four days after the attack, hackers used approximately 12,000 wallets across 11 blockchains and made more than 40,000 transactions—an average of one new wallet every 25 seconds. Funds were initially dispersed across thousands of Tron addresses and then moved to Ethereum through cross-chain bridges. The hackers also used decentralized exchanges to convert stablecoins into assets such as ether that issuers cannot freeze. Tether and Circle froze some remaining assets after about $786 million in stablecoins had been converted. The laundering later spread to Solana, following the movement of more than $500 million through intermediary wallets on Tron, according to Chainalysis. Elliptic also detected bitcoin mixing involving about 28 bitcoin, worth $2.2 million. Despite the complicated transfers, Elliptic said $2.85 billion—44% of the $6.43 billion it reported stolen—had been frozen or seized. About $3.24 billion remained in addresses associated with the theft, mostly in bitcoin and ether, and only a negligible amount appeared to have been cashed out. Elliptic said the laundering was proceeding more slowly than after the 2025 Bybit hack and expects remaining funds to be converted gradually, potentially through over-the-counter brokers and exchanges over several months. Binance said it was progressively restoring withdrawals for more crypto assets and networks. The exchange also said it had covered about 95% of the affected amount and was working with industry partners to source the less-liquid tokens that made up the remainder.

North Korea has denied US accusations that hackers linked to the country stole more than $6 billion from cryptocurrency exchange Binance. Kim Yo Jong, sister of North Korean leader Kim Jong Un, called the allegation a “grave political provocation” and dismissed it as “absurd rhetoric and nothing new,” according to state media agency KCNA. She also said Pyongyang had “issues to reconsider” in light of what it described as Washington’s hostility. The accusation came from the FBI, which attributed the theft to TraderTraitor, a hacking group linked to the North Korean state. The article describes the incident as the largest crypto-exchange heist on record, surpassing the approximately $1.5 billion Bybit theft in 2025, which was also attributed to North Korean hackers. Blockchain analytics firm TRM Labs reportedly linked the Binance attack to the same group and said most of the money was moved within 20 minutes. Analysts in Seoul told Reuters that the speed of North Korea’s denial could reflect concern that Washington might intensify efforts to disrupt a funding source widely believed to support the country’s arms development. The article notes that North Korea had not yet responded to former US President Donald Trump’s overtures about restarting summit talks. Separately, Binance said it would resume withdrawals for additional assets on several blockchains, including Binance Smart Chain, Ethereum, Solana, XRP and Sui, beginning at 04:00 GMT Tuesday. Selected tokens on Arbitrum, Optimism, Tron and Base were also included. Binance said it had replaced most of the stolen assets using its own funds.

North Korea has rejected US allegations that it was responsible for stealing more than $6 billion in cryptocurrency from Binance, calling the accusations “absurd rhetoric” and a political provocation. The denial was issued by Kim Yo Jong, the influential sister of North Korean leader Kim Jong Un and a ruling party official, and reported by state news agency KCNA. She said Washington was trying to portray North Korea as a “cybercriminal state” and wrongly attribute cybercrimes around the world to Pyongyang. The FBI said North Korea was responsible for the theft from Binance, the world’s largest cryptocurrency exchange, and identified the perpetrators as members of TraderTraitor, a North Korean state-sponsored unit. Investigators observed the group converting stolen assets into Ethereum and expected further laundering. Binance said it had covered most of the stolen assets using company funds. Kim Yo Jong warned that North Korea had “issues to reconsider” because of what it regards as US hostility, but did not specify what actions Pyongyang might take. The statement comes as North Korea has not publicly responded to US President Donald Trump’s overtures to resume summit diplomacy. Experts have suggested Pyongyang may still be weighing its options. The article notes that cybersecurity experts consider North Korean hackers among the world’s most prolific cryptocurrency thieves and say proceeds help fund the country’s weapons programs. North Korea denies links to cryptocurrency theft and other cybercrimes. Despite being one of the world’s poorest countries, it has directed resources obtained through illicit activity and activities prohibited by UN Security Council resolutions toward its ballistic missile and nuclear weapons programs.