Binance has linked the cyberattack on 29 October to North Korea. They based this on information from the Federal Bureau of Investigation (FBI). The attackers used fake job interviews to get into Binance's systems.
On Tuesday, Binance shared that around $6.34 billion in digital assets were impacted by this security breach on 29 October. The cryptocurrency exchange said it will take the financial hit instead of passing it on to users. They also mentioned that they have set aside more than 100 percent of the funds needed to cover the lost assets.
Binance reported that it has frozen or intercepted about $2.85 billion in assets and has replaced 98 percent of the affected tokens. "As of 31 October 2026, 98% of the impacted token assets have been replenished and are verifiable on our Proof of Reserves page. We are in the process of purchasing the outstanding, more illiquid assets," the exchange stated.
Investigation
Binance's investigation revealed that attackers gained unauthorized access to an internal wallet-signing service. They used this access to initiate transactions outside the normal withdrawal process. The company said this breach came from a multi-stage operation that included social engineering, harmful software, and unauthorized access to employees' devices.
"Our current investigation indicates that this was a sophisticated, multi-stage campaign. It was not a single isolated breach or a simple phishing incident," Binance explained. They traced some of the attack back to June 2026. An engineer on their wallet team downloaded tampered software while trying to install an AI coding tool.
Even though the security team noticed the problem, replaced the affected device, and changed related credentials, the attack had already exposed the engineer's role and others working on the wallet. In September, another engineer was targeted through a fake recruitment process where people pretended to be from a non-existent company.
Binance said this engineer went through two online interviews. They were then told to download an assignment containing harmful code onto their work computer. This malicious software reportedly compromised the engineer’s device. It let the attackers connect with an external server they controlled.
On 20 October, the attackers used the compromised computer and an internal AI tool to reach other employees, including an engineer with a special permission token. Binance said the attackers finally used credentials from the compromised employees to access wallet-signing operations and carry out the attack on 29 October.
The company reported that its security team detected and stopped 57 suspected cyber threat cases linked to North Korea throughout 2026. "Throughout 2026, Binance’s security team detected and prevented 57 suspected North Korea-linked cyber threat cases," the platform said. These attempts show the ongoing risk from state-sponsored actors targeting the cryptocurrency sector.
They also mentioned that the latest information from the FBI confirmed North Korea's involvement in the attack. "The latest information released by the Federal Bureau of Investigation indicates that the Democratic People’s Republic of Korea is responsible for this incident," Binance said.
Security overhaul
After the incident, Binance rebuilt the affected wallet system in a new environment. They also rebuilt their internal AI tool and access controls. Affected devices were replaced, and credentials related to compromised employees were canceled.
The company conducted enhanced security scans on employee devices and strengthened wallet-service risk controls. They expanded their use of AI to spot unusual behavior. Binance is working with law enforcement, blockchain intelligence firms, and industry partners to trace and freeze affected assets.
They also plan to hire independent cybersecurity experts to review the incident, confirm their findings, and suggest more security measures. Binance said it will increase investments in AI threat detection, endpoint protection, developer-environment security, and monitoring for unusual behavior.
The exchange aims to set up a security research fund and work with AI companies, industry players, and cybersecurity firms to improve security in blockchain environments. "This is our initial report. It covers what we know today and what we have already improved. The investigation remains ongoing, and our findings will be subject to further independent review," Binance stated.
Drop your comment
No comments yet — be the first to drop the gist 👇