North Korean-linked hackers stole $6.3 billion from Binance on October 29, 2026, the largest theft in crypto history, according to reports. Analysts note that hackers may need to compromise only one employee to get into a platform’s systems. Binance has said attackers compromised three engineers’ computers through a fake job interview and a booby-trapped software download.
The attack was not a single break-in but a prolonged operation. Binance said the attackers spent months preparing, reaching staff machines before moving cryptocurrency from internet-connected wallets over several hours. The attackers used 50 signing transactions to manipulate the affected account, and Binance’s team had to develop new procedures to revoke permissions while the theft was under way.
The method reflects a wider industry problem. Cybersecurity researcher Michael Barnhart of DTEX said that bogus job interviews are a recognised tactic and described the repeated attempts against Binance as evidence that the company was being barraged. The lesson for exchanges is that technical controls on wallets are only as strong as the people and devices that operate them.
The scale of the loss has made the attack a benchmark. Binance’s theft exceeds the $1.5 billion stolen from Bybit in February 2025, which the FBI attributed to North Korean hackers. The Wall Street Journal has described the group behind those attacks, known as TraderTraitor, as responsible for many of the largest crypto heists in recent memory.
Recovery has been partial. Binance and partner firms froze around $3 billion of the stolen assets. Blockchain analytics firm TRM said the hackers had already moved $2.4 billion beyond the reach of any issuer, which limits what can be recovered. Binance says it is working to recover more.
Exchanges are especially exposed because they hold assets on behalf of their customers. Unlike stock trading platforms, crypto exchanges often control the keys to user funds, which makes them attractive targets. The industry also lacks the regulatory oversight that applies to traditional finance, which leaves customer protection to the platforms themselves.
The attack has also raised questions about the role of artificial intelligence. Eswar Prasad, a Cornell economics professor who tracks the crypto industry, has argued that AI is turbocharging hackers’ ability to find and exploit subtle flaws across the ecosystem. Hackers can now test vulnerabilities faster and at greater scale than before.
The broader figures show the scale of the problem. Chainalysis estimates that the global crypto ecosystem lost more than $3.4 billion to hackers in 2025. Reports on state-linked theft put losses above $2 billion last year, which suggests that the Binance theft is part of a sustained trend rather than an isolated event.
Confidence in the sector is also at stake. Security experts have warned that the attack could deter public companies from adopting crypto-linked technology, and some have said it will prolong the sector’s downturn. The Week, citing the Wall Street Journal, reported that investors withdrew $3.6 billion when Binance reopened, which suggests that customers have not yet lost faith in the platform, although that figure is disputed.
The next signals will be Binance’s technical post-mortem, the promised proof-of-reserves update and any further recovery of frozen assets. Regulators and institutional investors will watch whether exchanges adopt stronger controls over staff devices and signing permissions.
