Binance has disclosed that hackers stole approximately $6.3 billion in cryptocurrency in an attack that began with compromised employee computers and fraudulent recruitment interviews, exposing weaknesses in the exchange’s internal security systems.
The world’s largest cryptocurrency exchange said on November 3 that the attackers conducted a months-long operation, using malicious software, stolen employee credentials and social engineering to gain access to systems involved in authorizing transactions.
According to Reuters, the campaign began in June, when an employee downloaded a tampered coding tool disguised as an artificial intelligence application. Binance detected the malware, replaced the affected computer and changed the compromised credentials, but the attackers had already gathered information about the employee and the wallet development team.
In September, hackers targeted another software engineer through a fake job interview. Posing as recruiters and company executives, they persuaded the employee to download a malicious code repository onto a work computer, giving them another route into Binance’s internal systems.
By October 20, the attackers had used the compromised device and an internal AI tool to access computers belonging to two wallet developers. Nine days later, they used stolen credentials to deploy a malicious script and execute unauthorized transactions.
The attack exploited Binance’s hot-wallet infrastructure, which processes transactions using internet-connected systems. The hackers used Ethereum’s EIP-7702 mechanism to establish malicious execution permissions over a wallet, enabling transfers outside the exchange’s normal withdrawal process, CoinDesk reported.
The bulk of the theft unfolded in approximately 20 minutes on October 29. Binance initially identified a compromised employee laptop as a possible entry point before its subsequent investigation uncovered the broader operation.
The exchange said approximately $2.85 billion in assets had been frozen or intercepted, while it had replenished about 98% of affected tokens using company funds. Binance also said it would commission an independent cybersecurity review and strengthen its security controls.
The incident prompted Binance to temporarily suspend deposits and withdrawals while it investigated the breach and worked with blockchain partners to freeze assets. The company pledged to cover losses and said customers would not bear the financial impact.
The FBI attributed the attack to North Korean hackers, according to Reuters. Binance said it was working with law enforcement, while North Korea has denied involvement in the alleged cyberattack.
The scale of the incident could make it the largest cryptocurrency theft on record, surpassing the approximately $1.5 billion stolen from crypto exchange Bybit in 2025. The breach also raises questions about the security of centralized exchanges, particularly the risks posed by compromised employee devices and access to transaction-signing infrastructure.
Binance said it had detected and prevented 57 suspected North Korea-linked cyber threats during 2026, including attempts involving fraudulent interviews and malicious software.
The attack highlights how hackers can target employees and development systems rather than directly attacking blockchain networks or stealing private keys. In Binance’s case, the attackers reportedly spent months building access before using it to move billions of dollars in digital assets.