By Binance says its security team detected and prevented 57 suspected North Korea-linked cyberthreats during 2026, even as attackers allegedly associated with the same country carried out a $6.34 billion cryptocurrency theft in October.
The disclosure appeared in Binance’s November 3 security report, which provided the first detailed account of the October 29 breach. According to the exchange, the blocked attempts involved fraudulent recruitment campaigns, compromised software packages, malicious browser extensions and fake video conferencing applications.
Binance co-CEO Yi He acknowledged that its defenses had intercepted numerous threats but failed to prevent the attack that ultimately compromised its wallet infrastructure. The Federal Bureau of Investigation has attributed the theft to North Korea’s TraderTraitor hacking operation, although Pyongyang has denied involvement.
Binance’s internal investigation remains ongoing, and the company has not established whether any of the 57 prevented incidents were directly connected to the successful attack.
Fake Job Interview and AI Tool Enabled Months-Long Intrusion
Binance’s investigation traced the earliest identified activity to June 2026, when a wallet infrastructure engineer downloaded a compromised Homebrew installer while attempting to install an AI coding tool. The exchange detected the suspicious software, replaced the employee’s device and rotated associated credentials.
However, attackers had already obtained information about the engineer’s responsibilities and colleagues. In September, another engineer received a recruitment approach through a legitimate employment platform. The attackers impersonated company representatives, conducted video interviews and presented convincing online identities before requesting that the employee download a coding assignment.
The repository contained malware that executed during installation, establishing unauthorized access to the employee’s computer. According to Binance, the malicious software evaded endpoint security controls and concealed evidence of its activity.
On October 20, attackers exploited the compromised device and an internal AI tool to gain access to two additional engineers’ systems. They subsequently obtained deployment permissions that enabled them to interfere with wallet infrastructure.
Nine days later, the attackers used stolen credentials to deploy a malicious container and execute unauthorized cryptocurrency transfers. The incident demonstrates how a coordinated intrusion can exploit multiple employees and internal systems rather than relying on a single compromised private key.
Binance Replenishes 98% of Affected Assets and Strengthens Security
Binance reported that approximately $6.34 billion in cryptocurrency was affected by the October 29 attack. As of November 3, the exchange said approximately $2.85 billion had been frozen or intercepted through cooperation with law enforcement agencies, stablecoin issuers and blockchain investigators.
It also reported replenishing 98% of affected token assets as of October 31, with the remaining assets requiring additional purchases because of limited liquidity. Binance said it had allocated more than sufficient corporate resources to cover the losses and pledged that customers would not bear the financial impact.
Following the incident, the company rebuilt affected wallet systems, replaced compromised devices and revoked exposed credentials. It also strengthened internal AI tool permissions, expanded behavioral anomaly detection and introduced additional controls for software development environments.
The exchange plans to commission an independent cybersecurity review and increase investment in AI-assisted threat detection. Binance is also exploring a security research fund and partnerships with technology companies to address emerging attack methods.
The disclosure raises broader questions about how cryptocurrency businesses protect employees from sophisticated recruitment scams and malicious software. Security researchers have repeatedly warned that North Korean-linked groups target developers through fabricated employment opportunities and technical assessments.
However, the FBI’s attribution remains disputed by North Korea, and the full forensic findings have not yet been independently published. For Binance, the challenge is demonstrating that its revised controls can prevent similar intrusions while completing customer asset restoration.
The 57 blocked threats illustrate the frequency of suspected attacks, but the successful breach underscores the consequences when layered security defenses fail.