Hackers stole approximately $6.3 billion in cryptocurrency from Binance on October 29, 2026, executing the largest digital asset theft in history during an intensive twenty-minute window.
Hackers Used Social Engineering and Trojanized Software to Compromise Employees
Binance described the breach as a sophisticated, multi-stage campaign
involving social engineering attacks and recruitment-themed lures directed at multiple employees, according to a post-mortem released by the company.
https://t.co/sU9dUqLQDH
The sequence began when an engineer on the wallet DevOps team searched for a popular artificial intelligence tool and downloaded a trojanized Homebrew installer. Although Binance detected the software and rotated credentials, hackers gained exposure regarding the employee’s role and infrastructure team colleagues. In September, attackers contacted a second engineer via a job-hunting platform while disguised as a project director, deploying malicious code during a fake interview setup process.
On October 29, the adversary used the second engineer’s compromised computer and an internal AI tool to gain control over additional wallet software engineers. Attackers discovered that the first engineer possessed a container deployment permission token, enabling them to initiate transactions across ten blockchains.
Binance Founder, CZ, issues big WARNING. "If a crypto exchange can be hacked, banks are in a worse position." "This is not just a #crypto problem. This is actually a much wider information security problem." pic.twitter.com/57NDwNY4Um
Starting at 20:05 UTC, the culprit transferred roughly USD 6.36 billion out of Binance wallets across ten blockchains over the course of roughly 20 minutes on the evening of October 29. Approximately four times larger than the February 2025 Bybit heist of USD 1.5 billion, this stands as the biggest digital currency robbery ever recorded.
Preparation began at least 36 hours before the theft. The first theft of the night came on the XRP Ledger. Binance co-CEO Yi He noted that Ripple assisted in blocking roughly USD 200 million from being transferred, and TRM has verified the onchain freeze of 40.5 million RLUSD.
Binance's initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions. We have found no evidence of any wallet private… pic.twitter.com/5REncAI77y
At 22:10 UTC, World Liberty Financial locked the 27.8 million USD1 located in the primary destination wallet, subsequently locking the USD1 within the compromised Binance hot wallet at 22:26 UTC.
Attribution to North Korean Hacking Unit
Federal investigators and blockchain intelligence firms attributed the attack to TraderTraitor, a North Korean state-sponsored hacking group. TRM Labs and the FBI noted that the same unit was responsible for the $1.5 billion Bybit hack in February 2025.
Around $3.13 billion remained in addresses linked to the theft, primarily as ether and bitcoin, while roughly $2.85 billion in affected assets had been frozen or intercepted by law enforcement and industry partners. Even after the stablecoin freezes, the amount the attacker still holds exceeds any previous theft. The perpetrator currently retains more than 420,000 ETH alongside 18,270 BTC—valued near USD 2.4 billion—along with smaller balances across alternative networks.
Kaiser Ng Leaves Binance as Justin Yek Becomes CFO
Binance Chief Financial Officer Kaiser Ng left the platform following the heist. Co-CEO Yi He stated that Ng decided to pursue a new venture after more than five years at the company, with a transition plan implemented over the preceding six months, naming Justin Yek as the new CFO. Yek most recently served as Airwallex’s vice president of finance.
Investigation update: Our initial investigation suggested that the security incident may have involved a compromised laptop, however our subsequent investigation has uncovered additional points of breach. This was a complex attack, and we are doing all we can in coordination… pic.twitter.com/FQQ3vKT6GU
Co-CEO Richard Teng confirmed that customers would not bear any losses, stating that the exchange replenished affected assets from its own reserves. Industry figures such as Michael Saylor warned that artificial intelligence tools will increasingly target vulnerabilities in digital asset exchange software. Saylor explained that weak digital commerce code is bound to be breached, and that AI models from laboratories like OpenAI and Anthropic give hackers greater capabilities.
Earlier coverage: Binance Appoints Justin Yek as New CFO After Hack
On 29 October, Binance was the target of one of the most sophisticated attacks the digital asset industry has ever seen. ~$6.34B in assets were impacted. We take full responsibility and we're making it right. No user bears the loss. We set aside more than the full amount… https://t.co/BDmr3wLzOP
More on Binance
🔥 LATEST: How much was Binance actually keeping in its hot wallets? Eight days after the $6.3B hack, Binance still hasn't said, while rivals like Coinbase, Gate and Upbit are rushing to publish their cold storage ratios. Should every exchange be forced to disclose this?…
Join Binance Co-CEOs @_RichardTeng and @heyibinance, alongside Chief Security Officer Jimmy Su, for a fireside chat. Moderated by @jessicasmw. 🗓️ November 9, 2026 🕛 12:00 UTC 📍 X Spaces Set your reminder → https://t.co/z4ldPDIuYl pic.twitter.com/F8ymkZsf9N
Binance hack update: the XRP has started moving. About $50 million has been swapped, mostly through THORChain into BTC, with about $226 million still to move. Bitcoin converted from other stolen assets is now about 1,650 BTC ($124 million), almost twice the figure a day earlier.…
🔥 LATEST: TRM Labs says it's time to hack North Korea back. The $6.3B Binance theft was roughly a third of North Korea's GDP, and TRM's Ari Redbord says the Lazarus-style raids won't stop as long as they keep paying off. "This is cyber war."https://t.co/bZxAinjRrg
Binance replaces its CFO nine days after a record hack Binance CFO Kaiser Ng is leaving the exchange to pursue a new venture after more than five years, and Justin Yek, most recently VP of finance at payments firm Airwallex, is taking over as finance chief. 1. Co-CEO Yi He said… pic.twitter.com/DX1vIHQOIH