Binance Suffers Record $6.34 Billion Crypto Theft in Sophisticated Hack
Hackers stole $6.34 billion from Binance in late October using social engineering, malware, and compromised employee credentials, marking history's largest crypto heist.
On October 29, digital assets valued at approximately $6.34 billion were stolen from the Binance cryptocurrency exchange in what is considered the largest crypto heist in history. Contrary to expectations, the breach did not begin with an attempt to hack the Bitcoin network or crack complex encryption. Instead, it started months earlier through seemingly innocent actions.
According to an initial report published by the exchange on November 3, attackers manipulated employees, computers, and internal tools to gradually infiltrate systems managing customer funds. The first phase took place in June 2026, when an engineer on the Binance wallet team searched online for an AI-based programming tool and inadvertently downloaded a compromised utility version prepared by attackers.
Social Engineering and Fake Interviews
In September, the next phase unfolded through a fabricated job offer. Another software engineer was approached by an individual posing as a company project manager, underwent a video interview with a fake human resources representative, and later spoke with a purported CEO. Although the company was entirely fictitious, the engineer was asked to download a programming task file during the second interview, which contained malicious software designed to bypass defense systems.
By October 20, the attackers exploited the compromised computers and Binance's internal artificial intelligence tool to gain access to the workspaces of two additional engineers. One of the computers contained permissions to activate components within the exchange's technological infrastructure, allowing attackers to manipulate the system responsible for authorizing fund transfers without stealing individual private keys.
Billions Stolen and Withdrawals Frozen
On October 29, within just four minutes, 233 million XRP tokens were transferred from five Binance wallets to attacker-controlled addresses, followed by about 970,000 SOL coins, over 44 million OP coins, and approximately 18,270 Bitcoins. Binance detected the anomaly, suspended withdrawals, and initiated containment efforts, though attackers utilized an Ethereum smart contract mechanism to continue draining funds for nearly four hours.
The FBI and blockchain analysis firm Chainalysis attribute the attack to North Korea-linked hackers, including the TraderTraitor group, while North Korea denies the allegations. As of November 3, Binance reported that roughly $2.85 billion of the stolen assets were frozen or intercepted, and the exchange pledged to absorb the losses, covering approximately 98% of the affected assets while gradually restoring withdrawal services starting November 1.
