Binance says it blocked 57 suspected North Korea-linked cyber threats in 2026, while working to replace assets lost in an Oct. 29, 2026, breach valued at $6.34 billion. The exchange says it has replenished 98% of the affected token assets. The attack route and the status of much of the stolen crypto remain unclear.
- Binance says a fake hiring process led to malware on an employee’s work computer.
- The FBI blamed North Korea-linked activity it calls TraderTraitor; North Korea rejected the accusation.
- Replacing customer assets does not mean the stolen funds have been recovered.
Binance describes a hiring lure and a compromised computer
In a Nov. 3, 2026, post on X, Binance co-founder and co-CEO Yi He described suspected intrusion tactics that included fake recruitment approaches, malicious software packages and browser extensions, counterfeit developer tools, and fake video-conferencing apps. Some, she said, sought credentials or installed malware that could enable remote access.
Binance’s initial account of the breach describes a suspected hiring scam. In September 2026, someone posing as a project director contacted a software engineer through a legitimate job-hunting platform. A supposed HR representative arranged a video interview. A second interviewer, presented as the CEO of a fictitious company, then asked the engineer to download an assignment onto a work computer.
Binance said malicious code ran during setup and evaded the endpoint security tools in use. These tools are designed to detect or block threats on individual computers.
On Oct. 20, 2026, the attacker allegedly used the compromised computer and an internal AI tool to reach two wallet engineers. Binance said credentials obtained during the intrusion later enabled access to wallet-signing operations, the processes that authorize transactions from crypto wallets. The exchange has not explained how the attacker got from the compromised computer to those operations or what role the AI tool played.
Yi He acknowledged the gap between intercepting many suspected attempts and stopping the breach:
“We intercepted many of them, but the cost of failing to stop even one was severe, and this should never have happened.”
Binance said it blocked 57 suspected North Korea-linked threats in 2026. It has not provided a breakdown of those cases or explained exactly what it counted as a threat. Yi He’s post did not say how many involved fake recruitment or interviews, so the figure cannot be directly linked to the breach.
Attribution and the blockchain trail
In an Oct. 31, 2026, cyber alert, the FBI attributed the theft to North Korea and identified the activity as TraderTraitor. The FBI said it worked with the U.S. Secret Service and IRS Criminal Investigation. On Nov. 3, 2026, Kim Yo Jong rejected the FBI’s accusation in a statement carried by North Korean state media, according to the Associated Press. The attribution reflects the FBI’s assessment. The available details do not lay out the evidence behind it or the grounds for Kim’s rejection.
Earlier findings traced part of the theft to Binance 14, a label for an Ethereum hot wallet, meaning a wallet connected to systems that can transact online. Blockchain security firm Blockaid identified 50 submitted EIP-7702 authorizations. One, Blockaid reported, successfully delegated execution rights to a malicious contract. In plain terms, that authorization allowed the contract to act on behalf of an account. The finding describes one part of the suspected activity, not a complete account of how the theft unfolded.
The FBI and its partner agencies said attackers were converting stolen assets primarily into Ether and expected further laundering through decentralized finance (DeFi) services and instant-swap services. DeFi services use blockchain-based systems, often without a traditional intermediary. Instant swaps exchange one cryptocurrency for another. The agencies urged exchanges, analytics firms, DeFi services and infrastructure operators to block transactions involving listed addresses or assets derived from them.
Blockchain analytics firm Elliptic reported that about 28 BTC, worth $2.2 million, entered 18 CoinJoin transactions between Nov. 1 and early Nov. 2, 2026. CoinJoin combines inputs from multiple users in a shared Bitcoin transaction, making it harder to link specific inputs to specific outputs. Using CoinJoin does not, by itself, show that funds have been successfully laundered.
At the time of Elliptic’s assessment, 18, 270 BTC taken directly from Binance remained in 19 addresses. Elliptic also estimated that theft-linked addresses held $3.24 billion, mainly in Ethereum and Bitcoin. Its tracing work covered roughly 12, 000 wallets across 11 blockchains and more than 40, 000 transactions.
The reported $6.34 billion theft value and Elliptic’s $3.24 billion estimate describe different things. The former is the reported value of the theft. The latter is an estimate of assets still held at theft-linked addresses when Elliptic conducted its assessment. The available figures do not provide a full accounting of the difference or show how those balances changed afterward.
Replenishment is not recovery
Binance said on Nov. 3, 2026, that it had replenished 98% of the impacted token assets and was still buying the remaining, less liquid tokens. Less liquid assets can be harder to buy in large quantities, which can slow replacement purchases. Binance has not given a completion date or explained whether its 98% figure is based on token quantities, dollar value, or another calculation.
According to Richard Teng, the exchange had reported approximately 95% replenishment when it reopened Bitcoin withdrawals on Nov. 1, 2026. On Nov. 3, Binance restored withdrawals for 31 additional assets on Ethereum and 20 on Solana, after reopening withdrawals for five Ethereum stablecoins.
Binance identified BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC as fully backed. It said other outstanding tokens took longer to buy in the required quantities. The exchange did not further explain what “fully backed” meant for each asset.
Earlier recovery disclosures said replacement purchases drew on Binance’s Secure Asset Fund for Users, excess reserves from its Futures Insurance Fund, and its corporate treasury. Binance also said it had set aside more than the funds required to cover the loss.
Replacing affected assets can restore customer balances, but it does not mean the stolen crypto has been recovered. Binance’s 98% figure describes its replenishment effort. Elliptic’s figures track funds associated with theft-linked addresses.
Key questions and answers
-
How many suspected threats did Binance say it blocked?
Binance said it blocked 57 suspected North Korea-linked threats in 2026. It did not disclose how many involved recruitment lures or explain its criteria for counting a threat.
-
Has Binance recovered 98% of the stolen funds?
No. Binance said it had replenished 98% of the impacted token assets, but that is not the same as recovering 98% of the stolen crypto. The exchange has not specified how it calculated the percentage.
-
Who did the FBI blame for the theft?
The FBI attributed it to North Korea-linked activity it calls TraderTraitor. Kim Yo Jong rejected the accusation, according to the Associated Press.
-
What did Elliptic find about the stolen funds?
Elliptic reported that about 28 BTC, worth $2.2 million, entered 18 CoinJoin transactions between Nov. 1 and early Nov. 2, 2026. At the time of its assessment, it estimated that theft-linked addresses held $3.24 billion.
Binance’s account highlights a familiar security weakness: attackers can target people and workplace systems before reaching sensitive crypto operations. The exchange says it has replaced most affected assets, but it has not fully explained how the alleged hiring scam led to wallet access or where the remaining funds are. North Korea-linked hackers have featured prominently in earlier crypto theft assessments.
