Binance CEO says ‘months-long campaign’ led to $6.3 billion theft as N. Korea denies responsibility

Cryptocurrency giant Binance said North Korean hackers used a months-long attack involving multiple company employees to stage its headline-grabbing theft of $6.3 billion last week. 

The company released a post-mortem on Tuesday morning, outlining a campaign that dates back to June and involved the compromise of multiple employee devices. 

Binance CEO Richard Teng called it a “months-long campaign” that wasn’t the result of “one mistake or one breach.”

“Our current investigation indicates that this was a sophisticated, multi-stage campaign. It was not a single isolated breach or a simple phishing incident,” Binance said. “The attackers combined a range of techniques, including social engineering by fake recruitment interviews, malicious software downloads, compromised internal AI tooling, endpoint compromise, and an advanced transaction-authorisation method.”

Investigators said the breach started in June, when an engineer downloaded malicious software to install a popular AI coding tool. Binance’s security team detected the malicious software and replaced the device but the hackers gained access to crucial information about the engineer and other people on the developer team.  

The company noted that throughout 2026, it has caught and stopped 57 separate attempts by North Korean actors to breach the company, compromise employees or break into corporate systems. 

These attempts involved fake job interview offers, malware disguised as developer tools, compromised browser extensions, malicious video conferencing tools and other social engineering campaigns.

Started with one device

By September, one of the campaigns was successful in compromising the device of a software engineer who was contacted for a fake job offer. During the second interview, the Binance employee was told to download an assignment that contained a malicious code repository.

That download kicked off the attack that led to the theft, giving the hackers access to Binance systems and the ability to replace legitimate tools with malicious ones. 

The malware was not detected by Binance’s endpoint security protection tools, and the company said the attacker took further steps to conceal the malicious activity — removing traces of the initial compromise.

By October 20, the hackers began to move laterally, using their access to the compromised device of the engineer to gain control of two other devices. The attackers successfully got into critical cryptocurrency wallet tools by October 29 and used credentials stolen from the breached employees to trigger the initial attack. 

Binance said the hackers used an internal wallet signing service to initiate the first transactions, which saw almost $400 million in various cryptocurrencies flow out of the platform. 

The company was alerted to the large transfers and began an investigation, but then $1.4 billion in bitcoin left the platform. The hackers used other mechanisms to conduct 50 other transactions that enabled the theft of $6.34 billion.

Binance quickly coordinated with other platforms to freeze about $2.85 billion in assets and suspended withdrawals but could not stop millions more in funds from being stolen.  

The company said it lost valuable time in stopping the attack because it had to develop specialized procedures in the moment to revoke access and authorizations. 

“We have taken immediate action to contain the incident and strengthen the systems involved. The entry points identified as having been used in the attack have been closed,” Binance said. “Systems touched in the attack path have been rebuilt or replaced. We have also implemented tighter device controls, enhanced wallet-service risk controls and expanded AI-based behavioural anomaly detection.”

Binance said it has taken several other actions to enable quicker responses to security incidents. All of the compromised devices and wallets have been replaced, while the credentials used in the attack have been decommissioned. 

It has also hired a security company to conduct a review of the incident to validate its findings and recommend additional actions. 

The tactics described by Binance resemble dozens of other attacks North Korean hackers have conducted over the last five years. 

Multiple cryptocurrency companies have reported laptops infected with malware as the source of breaches while Google and other cybersecurity firms have warned of North Korean campaigns using fake job interviews and exams as a way to gain entry to blockchain firms. 

Earlier this year, alleged North Korean groups stole $290 million from the Drift crypto platform in another sophisticated operation involving fake companies, alleged actors and more. 

North Korea denies role

Over the weekend, the FBI and other U.S. agencies blamed the theft on North Korea’s TraderTraitor — a state-sponsored group that has spent years perfecting lucrative attacks on cryptocurrency exchanges and platforms. 

North Korean spokesperson Kim Yo Jong denied the country’s role in the attack on Monday, calling it an “absurd” effort to “damage the international image of the DPRK.”

“It is the consistent policy stand of the DPRK government to resolutely oppose all sorts of malicious acts in cyberspace, the wealth common to mankind, and resolutely reject any attempt to politicize the cyber issue and use it as a means of interfering in the internal affairs with other countries,” Kim said.

The spokesperson eventually accused the U.S. of confiscating “illegally stolen cryptocurrency assets,” in an apparent reference to the Justice Department’s seizure of $15 billion worth of bitcoin from accounts allegedly linked to the chairman of a prominent Cambodian conglomerate who was indicted on charges that his company is behind a sprawling scamming empire.

Blockchain security firms like Elliptic said the hackers have used about 12,000 wallets across 11 blockchains to conduct about 40,000 transactions while shuffling funds to a new wallet every 25 seconds. 

Investigators from the United Nations and several other countries said North Korea has been responsible for stealing billions from cryptocurrency companies since 2017 — with much of the stolen money used to fund its sanctioned ballistic missile programs.