Hackers took about US$6.3 billion in cryptocurrency from Binance on 29 October, in what may be the largest financial theft on record.
How it happened
- June: A wallet developer downloaded a tampered tool that had been promoted in a search ad.
- September: Another engineer was approached with a fake job interview and a malicious code repository.
- The attacker used these machines to reach the systems of two wallet developers, then ran a malicious script from one of them.
- About 233.46 million XRP left five hot wallets in four minutes, followed by other cryptocurrencies. The last unauthorised transfer came nearly four hours after the attack began.
Attribution
The FBI has blamed a North Korean hacking group. North Korea rejects the claim.
Binance’s response
Binance suspended withdrawals, froze affected tokens and removed unauthorised permissions, freezing about US$2.85 billion in assets. It apologised and says it will repay every customer whose funds were stolen.
The exchange plans to expand AI-based threat detection and set up a security research fund. It says it detected and blocked 57 suspected North Korea-linked threats earlier in 2026.
