Binance Detects 57 Suspected Cyber Threats Linked to North Korea in 2026
Key Facts
Binance said in a report published on November 3 that its security team detected and blocked 57 cyber threat cases suspected of being linked to North Korea during 2026. The company distinguished these cases from a separate security incident on October 29, involving unauthorized access to its internal wallet-signing service. That access allowed transactions to be initiated outside the usual withdrawal process, the company said. Binance said the last unauthorized transfer, worth 2,961.9 ETH, was completed on-chain at 23:56 UTC that day. It added that it had detected no unauthorized transfers after that.
Binance estimated that digital assets worth about $6.34 billion were affected by the incident and said about $2.85 billion had been frozen or intercepted as of its update on November 3. It said these figures were preliminary and subject to reconciliation and price volatility. The company said it would bear the financial impact of the breach rather than customers and had allocated more than the full amount needed to cover it. By October 31, it had replenished 98% of the affected assets, according to its statement. It told Reuters it would compensate all customers whose funds were stolen in the incident.
Binance described a chain of events that began with human-targeted infiltration and later targeted internal tools, devices and systems. In September, someone posing as a project manager contacted a software engineer through a seemingly legitimate job-search platform, followed by an initial video interview with a fake human-resources representative. After a second interview, the engineer was asked to download a code repository onto a work computer. The company said the repository contained malicious code that ran during setup, triggering a series of unauthorized activities. The fake human-resources representative shared a social-media account featuring personal photos and videos, Binance said, to build trust with the engineer.
In another incident, the report said, an engineer on the wallet development team downloaded a modified Homebrew installation in June while installing an AI coding tool. Binance said it detected the anomaly, replaced the device and rotated the credentials associated with it. The report described the campaign as multi-stage, involving fraudulent job interviews, malicious software downloads, compromise of internal AI tools and employee devices, as well as an advanced method for authorizing transactions. The company did not say that all 57 cases followed the same recruitment path or sought the same objective; it said some campaigns aimed to steal credentials or install software that enabled remote access.
Binance said it rebuilt the affected wallet system, internal AI tool and access controls, replaced affected devices, and revoked credentials and tokens associated with the engineers involved. It said these measures had been taken by November 3. The company also announced that it would commission independent cybersecurity experts to conduct a comprehensive review of the incident, verify its findings and recommend further measures. It also plans to increase investment in AI-supported detection and the security of development environments. The incident linked the risk of targeting employees to potential access to tools on which wallet systems rely, according to details provided by the company.
Against the backdrop of this approach, the U.S. Federal Bureau of Investigation warned in September 2024 of social-engineering campaigns targeting employees of cryptocurrency and decentralized-finance companies to deploy malware and steal corporate assets. Among the warning signs cited by the bureau were job tests that require running unfamiliar code or repositories. In July 2025, the bureau said some North Korean workers use people in the United States, knowingly or unknowingly, to obtain fraudulent jobs and access company networks, and that intermediaries may attend virtual interviews on their behalf. In a separate incident that year, the bureau attributed the theft of about $1.5 billion in virtual assets from the Bybit platform to North Korea. A researcher at DTEX told Reuters that fake job interviews are a known tactic used by cyber actors.
Binance said the price and value of the affected assets would not change its commitment to cover customer losses, while reports described a market reaction on October 30, the day after the incident. Bitcoin fell to a six-week low, dropping 3% to $76,469.82, while Ether declined more than 3% to $2,185.83. Coinbase shares also fell 4.8% in extended U.S. trading. Reuters quoted a GSR analyst as saying that the average spot Bitcoin bid-ask spread was five times wider than usual that morning, and 2.5 times wider for Ether, before narrowing slightly. A Chainalysis analyst told Reuters that at least $5.912 billion in theft had been confirmed as of 8:30 p.m. Eastern Time on October 30, with funds moving across several networks.
In a separate attribution of the attack, the Federal Bureau of Investigation attributed the Binance theft to the TraderTraitor group, linked it to the $1.5 billion Bybit theft the previous year, and urged cryptocurrency platforms and blockchain analytics firms to block transactions associated with the group's addresses. The Associated Press reported that North Korea denied involvement in the Binance theft and called the U.S. announcement a provocation. An analyst quoted by the agency predicted that the attackers would try to split up and launder the stolen assets through smaller platforms to evade detection, in a process that could take months. Binance said it would continue releasing information as it becomes available while preparing for the independent cybersecurity review.