North Korea-linked hackers steal record $6.3 billion from Binance

New reports detail the recruitment scam: outreach via a job site or LinkedIn, fake HR interviews and a task from a bogus CEO that infected the machine when run, undetected by antivirus.

Report details that, from engineer B's compromised computer, attackers used the internal AI tool as a springboard to seize control of wallet DevOps engineer A and wallet software engineer C.

TechCrunch notes that experts had warned for years about North Korea's patient hacking tactics, yet the exchange was still caught off-guard in the $6.3 billion heist.

New detail on the $6.43B theft: the attacker used engineer B's compromised computer and an internal AI tool as a springboard to gain control of the Wallet DevOps Engineer and another Wallet Software Engineer.

New details on the vector: an engineer searching for an AI tool installed the tampered Homebrew, and the fake interview coding test hid malware that evaded detection; Binance caught the first intrusion, but attackers learned who worked on its wallets.

Binance's preliminary incident report details the theft timeline: an engineer infected in September via a fake hiring assignment, that computer plus an internal AI tool used on Oct 20 to compromise two more engineers, and stolen deployment credentials reaching the wallet-signing service on Oct 29.

Binance's report details months of preparation: one engineer installed malware in June after a fake interview and had his device replaced, and a second downloaded a malicious test assignment in September after two interviews with a non-existent company.

Researcher sums up Binance's published details: the theft was plain social engineering, not an AI attack exploiting a zero-day.

Posts add attack-chain details: a malicious Google ad reportedly started the infection via a fake interview with a coding assignment, and attackers exploited Ethereum's EIP-7702 to control a hot wallet, contained in about four hours.

Binance officially describes the theft as a sophisticated, multi-stage campaign, not a single isolated breach or simple phishing.

Binance detailed the attack chain, with fake interviews, a trojanized Homebrew installer and abuse of an internal AI tool, and the theft amount rose to $6.43 billion.

Binance CEO says a months-long campaign using fake recruitment interviews led to the $6.3 billion theft; North Korea denies responsibility.

Security researcher Rachel Tobac highlights that the attack chain began with social engineering using an interview or recruitment pretext to trick the target into downloading malicious tools or handing over credentials.

Binance confirms the initial vector: a fake job interview with a malicious code download, and says the FBI attributes the case to North Korea.

Binance reveals the initial attack vector: a fake job interview infected an employee's computer before the AI tool hijack.

Binance details that the exchange's own AI tool was used against internal wallets in the $6.3 billion theft.

Binance says hackers used a fake job interview to hack an employee and gain access to its internal crypto wallets.

North Korea officially denies involvement in the hack: Kim Yo Jong called the U.S. claim "preposterous nonsense" and suggested, without providing evidence, that the Trump administration itself could be responsible, pointing to the U.S. Strategic Bitcoin Reserve.

Tracking cites 7,541 wallets under watch, with 3,849 still holding some funds and active movement through bridges.

The FBI formally attributed the Binance attack to North Korea's TraderTraitor group, calling it the world's biggest cyber heist.

FBI officially attributes the attack to North Korea's TraderTraitor and flags over 600 addresses used to launder the stolen funds.

Binance reopens operations and users withdraw $4.649 billion in nine and a half hours; exchange says it has restored about 95% of the stolen assets.

X post says Binance has fully covered the lost assets and has begun reopening withdrawals.

BleepingComputer reports that the FBI publicly links the roughly $6.3 billion heist to North Korean hackers.

FBI, Secret Service, and IRS-CI officially attribute the $6.43 billion theft to North Korea's TraderTraitor group.

Technical analysis says the attackers compromised a hot wallet key and an internal signing service, and that ADA and NIGHT balances escaped because they sat in a Cardano multisig with a separate key.

UK press calls it the biggest heist in history; Binance blocks customer withdrawals while racing to recover funds.

Binance halted withdrawals after the attack; around $3 billion in stolen assets were reportedly frozen and the US Secret Service confirmed it is tracking the funds to recover them.

A Binance spokesperson says customer funds were not affected and the money came from one of the exchange's own hot wallets.

Social media report claims the attackers used a self-destruct mechanism that automatically wiped their tools and traces as they advanced.

US senator says hackers took more than $6 billion in under 4 hours and calls it the biggest heist in history, using the case to push the Clarity Act, which would give crypto firms legal cover to freeze suspicious transactions at law enforcement's request.

International press echoes the record theft of over $6 billion from Binance and reinforces the attribution to North Korean hackers.

Reports on the case say the roughly $6.36 billion theft, attributed to North Korea, was completed in about 20 minutes.

Binance co-CEO admits in a video the company should have invested more in security, describes a very complex multi-layered composite attack and promises a full technical report; CEO Richard Teng confirms the EIP-7702 delegation behind the attack did not pass through normal approval controls and was

New reports say the intrusion started from an engineer's computer, with funds drained in roughly 20 minutes; about $3 billion was frozen with Tether and Circle's help and Binance expects to resume withdrawals.

Blockchain analysis firms and Binance froze roughly half of the stolen funds; the exchange will cover all losses.

Chainalysis and Pangolin Intelligence now attribute the attack to North Korea with high confidence; entry reportedly came via an engineer's computer.

Social media post reiterates attribution of the attack to North Korea, in line with TRM Labs' earlier analysis.

TechCrunch reports the intrusion is suspected to have started by compromising a Binance employee's laptop, enabling the multi-billion theft.

Social media post repeats the attribution of the $6 billion-plus Binance theft to North Korean hackers.

Chainalysis and Elliptic also attribute the theft to North Korea with high confidence; zachxbt traced the funds to the same address as last month's Bitget hack via THORChain, linking both hauls to the TraderTraitor group.

Binance says the attack began on a DevOps engineer's laptop and the investigation uncovered additional points of breach; withdrawals remain paused.

TRM Labs links the theft to North Korea's TraderTraitor group with high confidence; wallets were drained across 10 blockchains in about 20 minutes.

Binance halted withdrawals after the theft and pledged to cover customer losses; analysts pin the attack on North Korea.

CZ publicly addressed the $6.3 billion theft and cited Binance's SpaceX position worth over $1 billion; reports reiterate movement across ten blockchains.

Infosecurity Magazine covers the record theft, reiterating attribution to a North Korean hacking unit, with no new facts beyond what was already recorded.

New reports detail the drain took about 20 minutes, with roughly $3.79 billion in Ethereum and $1.47 billion in Bitcoin; TRM Labs ties TraderTraitor to the Lazarus Group. Mainstream outlets such as GloboNews now cover the case.