Binance says months-long campaign stole $6.3 billion in crypto
Original title: Binance CEO says ‘months-long campaign’ led to $6.3 billion theft as N. Korea denies responsibility
FBI blames North Korea’s TraderTraitor; Pyongyang denies it, and about $2.85 billion was frozen.
Binance’s Tuesday post-mortem says a campaign from June compromised multiple employees and led to last week’s theft of about $6.34 billion. Attackers used fake job interviews, malicious downloads, compromised internal AI tooling, endpoint access and a wallet signing service. About $2.85 billion was frozen. The FBI attributes the theft to TraderTraitor; North Korea denies it.
Unconfirmed: North Korea denies responsibility; U.S. agencies attribute the theft to TraderTraitor.
- An engineer’s June download of a tampered AI coding tool was detected and the device replaced.
- A September fake-job assignment compromised another engineer; lateral movement began October 20.
- Wallet tools were reached by October 29; first transfers were nearly $400 million, then $1.4 billion in bitcoin.
- Binance says it stopped 57 separate North Korean attempts against the company during 2026.
- Elliptic says funds moved through about 12,000 wallets on 11 blockchains.
Impact: About $6.34 billion in cryptocurrency stolen from Binance
- 1.Replace compromised devices and decommission credentials used in the attack.
- 2.Review wallet-service authorizations and internal AI tooling access.
- ATT&CK
- T1566.003 Spearphishing via ServiceT1204.002 User Execution: Malicious FileT1078 Valid Accounts
- Vendors
- Binance
- Threat actors
- TraderTraitor
- Victims
- Binance
- Countries
- North KoreaUnited States
From the original article
4 min read at therecord.mediaNorth Korean attackers "combined a range of techniques, including social engineering by fake recruitment interviews," Binance said about the multibillion-dollar crypto heist it discovered in October.
therecord.media
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.