Binance $6.3B Hack: Inside the Exchange Heist

The job interview

Binance’s November 3 account is an initial report. The company says the investigation is still open, that outside firms will review it, and that some technical detail will stay private so the next attacker cannot copy the recipe. Read it as the venue’s own reconstruction, not as a finished case file.

The reconstruction is a campaign, not a single afternoon. Richard Teng, Binance’s co-CEO, told CNBC on November 3 that the attackers “spent months building their way in.” He rejected the idea of one employee’s laptop as the whole explanation. In June, he said, they stood up a fake version of a developer tool and got an engineer to install it. In September they posed as recruiters, ran a series of interviews with another engineer, and ended on a coding exercise that hid malware meant to slip past security. From there, Teng said, they moved through internal AI tools and reached the system that authorizes wallet transactions.

The blog post fills in the October steps with job labels instead of names. On October 20 the attacker used a compromised computer, the one belonging to the engineer Binance calls B, and an internal AI tool. That reach extended to the wallet DevOps engineer, A, and to another wallet software engineer, C. On A’s machine sat a token that could deploy a container, the kind of permission that lets someone start software inside the company’s own systems.

On October 29, between 17:15 and 19:56 UTC, Binance says the attacker logged into C’s computer, used credentials taken from A, deployed that container, and ran a malicious script. The script’s target was the internal wallet signing service. A signing service is the desk that turns an approved withdrawal into a signature the blockchain will accept. Get that desk to sign, and you do not need to steal the key. You need the desk to believe the order is real.

Teng did not himself attribute the theft. He said the FBI had. The October 30 notice had described one DevOps laptop and said no private-key leak had been found. The November 3 post, still labeled initial, is the longer path: recruiting, malware, and an internal AI tool.

The FBI’s piece of this chapter is shorter and harder. On October 31 the bureau said North Korea was responsible for the theft of more than $6 billion in virtual assets from Binance, on or about October 29. It calls this specific activity TraderTraitor. Partners named on the alert are the U.S. Secret Service and IRS Criminal Investigation. They had watched stolen assets being converted primarily into ether. They expect more laundering through DeFi and instant-swap services. The alert publishes a long address list and asks exchanges, DeFi services, node operators, and analytics firms to block transactions tied to those addresses.

TraderTraitor is not a new label. The FBI used it for the February 2025 Bybit theft, about $1.5 billion on the bureau’s figure. Elliptic, which had already assessed TraderTraitor as the likely Binance attacker, says this incident is more than four times the $1.46 billion it tracked leaving Bybit. Chainalysis had said on October 1 that the Bitget hack alone pushed 2026 DPRK-attributed crypto theft past $1 billion on its books. Binance lands on top of that year. It does not replace it.

Thirty minutes

Binance’s clock and Elliptic’s clock describe the same evening from two seats. Where they disagree, both numbers stay.

1. 17:15–19:56 UTC, Oct. 29 Binance says the attacker was on engineer C’s computer, deploying a container with engineer A’s credentials and starting the script aimed at the signing service.
2. 20:05–20:09 UTC Five Binance hot wallets on the XRP Ledger sent 233.46 million XRP to one attacker address. Binance says wallets on Solana and Optimism then sent about 970,500 SOL and 44.2 million OP. An internal alert on large transfers fired, and the company says it started investigating.
3. About 20:20–20:24 UTC Elliptic says one transaction carried 50 authorizations signed with the key of the hot wallet known as Binance 14. Each authorization used a different nonce, the wallet’s transaction counter, so one of them would match. Control of that wallet was delegated to an attacker contract. About three and a half minutes later the wallet was swept: 167,464 ETH and 63 other tokens, including 1.6 billion USDT, in Elliptic’s count. Binance says 18,270 BTC left a hot wallet in this same stretch, and that the 50 signatures were there to set up the delegation.
4. 23:56 UTC Binance says the last unauthorized transfer, 2,961.9 ETH, finalized on-chain. It had been broadcast earlier and sat pending. Elliptic saw a second wave on Avalanche and Polygon shortly after 23:00 UTC, and a last sweep of fresh deposits into Binance 14 at 23:56.
5. 00:10 UTC, Oct. 30 Binance says it sent a new authorization from Binance 14 to the zero address. That cleared the delegation code. No further unauthorized transfers were observed after the 23:56 ETH transfer.

Elliptic’s chain list is wider than Binance’s opening lines: after the XRP, it also saw Solana, NEAR, Base, Optimism, Bitcoin, Tron, Ethereum, Arbitrum, and Avalanche. Eleven chains. Ethereum was the largest slice, $3.80 billion across 186 tokens at the time of the theft, and $2.53 billion of that left in one transaction at 20:24 UTC. The 18,270 BTC was worth $1.48 billion then. Elliptic left out a further $169 million that moved after the withdrawal pause, to old addresses it reads as Binance moving its own funds. That is one reason $6.34 billion and $6.43 billion can both be serious. Chainalysis starts its story at 4:20 p.m. Eastern, 20:20 UTC, which is the Ethereum delegation, not the 20:05 XRP send.

The tool on the Ethereum side has a dull name. EIP-7702, from the 2025 Pectra upgrade, lets an ordinary account hand some of its behavior to a smart contract. The account signs an authorization that says this code may act for me. It does not publish the private key. Binance says the attacker used the signing service to create that authorization, and that the hot wallet is secured with multi-party computation, which splits signing so there is no single key in one file. That design blocked the obvious fix. Staff had to build a procedure to clear the delegation. Suspending withdrawals was not enough, the company says, because the authorizations already lived on-chain, outside the normal withdrawal path. Elliptic’s trace matches that shape. The delegation stayed up, later sweeps did not need a fresh signature, and Binance 14’s authority over another Binance wallet was used to pull 823 million USDC. A different hot wallet, Binance 16, sent 28,006 ETH and other tokens worth $174 million in ordinary signed transactions. The reading from the chain is that someone could instruct the signing infrastructure.

The script arrived early. Elliptic says a new wallet took three 0.1 ETH withdrawals from Tornado Cash on October 28 and 29, deployed the sweeper at 15:59 UTC, and rehearsed it on another wallet about four hours before Binance. Chainalysis describes the same Tornado-funded operational wallet. This was not written during the theft.

The freeze

A stablecoin has an issuer. Bitcoin does not. That sentence is the freeze. USDT, USDC, and a handful of other tokens can be blacklisted by the companies that redeem them. Ether, bitcoin, XRP, SOL, and NEAR cannot. The attacker’s first job after the theft, if the goal was to keep the money, was to turn the freezable pile into something no issuer can stop. The industry’s job was to freeze first.

Elliptic times it tightly. The stolen USDT reached the attacker’s main Ethereum wallet at 20:24 UTC. Tether froze that wallet 37 minutes later and locked 1.18 billion USDT, then froze four more attacker addresses within 17 minutes. Circle froze 823 million USDC in the same wallet three minutes after that. Ripple, World Liberty Financial, Paxos, and First Digital froze further stablecoins. Tether froze tokenized gold. Binance froze WBETH, a token it issues. The Arbitrum Security Council moved assets out of the attacker’s reach. On October 31, Optimism governance moved 44 million OP, about $5 million, out of an attacker address. Elliptic’s verified frozen or seized total, at about 05:50 UTC on November 1 and at then-current prices, was $2.85 billion. Stablecoins were 94 percent of that. Arbitrum and Optimism were the only chains where everything stolen had been secured, and in both cases the network’s own governance did it. Nothing stolen as native bitcoin, XRP, SOL, or NEAR was frozen, because there is no issuer to call. Ripple can freeze RLUSD. It cannot freeze XRP.

Chainalysis times the first freezes to 5:14 p.m. Eastern, 21:14 UTC. Before that, it says, the attacker moved $500 million of stablecoins toward a swap wallet. Over nearly 20 minutes, $325 million became $285 million of ETH, and the remaining $175 million went to stopover wallets. Elliptic’s swap line is a different cut of the same race: 434 million USDT swapped for 160,451 ETH, at prices 12 to 26 percent worse than the market. The attacker paid a spread to leave a token an issuer could still blacklist. Do not add the two tallies. A second wallet, in Elliptic’s trace, posted 59.9 million USDT on Aave and borrowed 19,762 ETH. Aave then froze the affected markets. The loan was still open, and close to liquidation. That freeze stopped new borrowing. It did not seize the collateral.

The frozen total moved with the blacklist and the price. Binance said about $3 billion on October 30 and about $2.85 billion on November 3, “subject to reconciliation and market price volatility.” Chainalysis said about $2.8 billion at 11:30 a.m. Eastern on November 3. A frozen figure without a clock is a smoothed tape.

What the freeze missed can still move. Elliptic, at the prices it was using, put about $3.25 billion of unfreezable coins across more than 800 addresses: about 584,000 ETH ($1.32 billion), 18,327 BTC ($1.42 billion), and 233 million XRP. The bitcoin had been peeled into 19 addresses, most holding 1,000 BTC, and had not reached a service. On Tron, one laundering wallet sent 1,113 transfers into November 1, median gap 90 seconds, including both nights in Pyongyang. Chainalysis saw new addresses receive exactly 1 TRX, then more funds, then forward them, and reads that as a script. Elliptic says some of that Tron flow moved alongside Bitget’s September proceeds. Chainalysis says it watched the commingling live, and that this link is why it named TraderTraitor at 12:30 a.m. Eastern on October 30, before the FBI’s public alert. Neither firm claims an AI agent laundered the coins. Binance’s AI-tool point is about how the attacker got in.

The rehearsal

Bitget’s theft was on September 24, 2026. It is not a footnote to Binance. It is the earlier exchange break that tracing firms use as a bridge into the October attribution, and it is a reminder that “North Korea took a billion this year” was already a 2026 sentence before anyone touched Binance 14.

Bitget’s own update, dated September 25, raised the loss from an initial $351.6 million to about $387.5 million. The extra was a fuller count, adding Zcash and TRON transfers the first estimate missed, not a second raid. The company said the incident was contained and that no further unauthorized transfers were possible. Assets named include XRP, ETH, USDT, ZEC, USDC, USDT0, XAUt, BNB, AVAX, and TRX. Bitget published receiving addresses on EVM chains, the XRP Ledger, Zcash, and TRON, and said it would announce when withdrawals could resume.

The path in was not a fake interview, or at least that is not the path the investigators described. Mandiant, part of Google Cloud, and SlowMist reviewed the breach. CNBC’s October 2 account of those reports says the attackers used a previously unknown flaw in a third-party security product. The earliest malicious log activity the reports could see was August 31. From there they obtained privileged internal access and could spoof transaction data so Bitget’s own authorization process moved funds out of hot and warm wallets. Private keys were not stolen. Cold wallets were not the target. Gracy Chen, Bitget’s CEO, told CNBC that about $1.1 million of the nearly $388 million had been frozen, and that frozen did not mean returned. She said the protection fund used to cover users had been refilled to $300 million from company reserves. She would not name the third-party products, citing the risk of handing the next attacker a map. The Mandiant and SlowMist reports, as CNBC described them, did not themselves blame North Korea. Chen had said earlier that technical indicators were consistent with known North Korean groups, and that a firm attribution would have to wait.

Chainalysis did not wait as long as that sentence. On October 1 the firm attributed the Bitget theft to DPRK-linked actors. In the first three hours, $387 million left in 23 transfers: Ethereum 49.7 percent, XRP 40.8 percent, Zcash 7.6 percent, Tron 1.8 percent. The firm said the theft pushed crypto stolen by North Korea-attributed actors in 2026 past $1 billion. Elliptic later said Binance coins and Bitget coins were combined in several wallets on the Tron side, a link it says was first flagged by the investigator ZachXBT and then confirmed in Elliptic’s own trace. Chainalysis calls that commingling the strongest evidence in its Binance attribution, observed live, not reconstructed months later.

The rhyme is the signing desk. Bitget: a vendor flaw, a spoofed approval, keys still in the building, about $1.1 million frozen against $387.5 million gone. Binance: recruiting and an internal AI tool, then a signing service, keys described as unleaked, about $2.8 billion frozen against a hole near $6.3 billion. One freeze changed the economics. The other barely did.

Aftershock

On November 2, Mercado Bitcoin, the large Brazilian exchange, told clients it had found a security incident in the early hours, contained it, and paused deposits and withdrawals. Its 21:00 update that day is the document to trust over the first wave of headlines. The exchange said clients will not lose assets. It explained the setup the way a teller would. A small share of coins sits in online wallets, the hot wallets, used like a shop’s till for ordinary deposits and withdrawals. Most of the coins sit in offline cold wallets, the vault. The incident hit the till. It did not hit the vault.

With help from Tether, Circle, BRL1, Paxos, and Chainalysis, the exchange said about $11 million was blocked and about $38 million was not. It did not publish one gross number. Security firms had estimated more than $40 million earlier that day. CoinDesk said there was no public evidence tying the flows to Binance. This desk has not found any either. No agency has named an attacker. Mercado Bitcoin has not described a fake interview, a signing-service compromise, or an EIP-7702 delegation, and it has not published an overlap with the FBI address list. Similar costume. Unknown author.

The exchange also told clients it does not ask for passwords, verification codes, or recovery phrases, and it does not offer refunds over a link or a phone call. After a named theft of this size, that warning is part of the story. The people who write to customers afterward do not need a state sponsor to get paid.

The bill

Binance’s October 30 notice says losses will be covered from the SAFU fund and from company funds, and that user funds are safe. SAFU is the emergency pot. The company’s own FAQ, describing it as of February 2026, puts that pot at about $1 billion, held in part with Nest Clearing and Custody Limited in Abu Dhabi Global Market. February is not October, and about $1 billion is several times smaller than a $6.34 billion hole. The clause that actually carries the loss is company funds.

Elliptic reported that Binance had reserved more than $6.34 billion for the cover, that about $5 billion of that reserve was already held in the same tokens that were stolen, and that the rest was being bought in the market and in OTC trades. Teng told CNBC on November 3 that 98 percent of the $6.34 billion in affected assets had been replenished, and that the remainder was the less liquid tokens, still being purchased. “Replenished” here means the house bought or allocated coins to refill what the attacker took. It does not mean the attacker gave them back. The frozen $2.8 billion is a recovery project with issuers, councils, and courts still in the way. The unfrozen bitcoin and ether are a laundering project. Both can be true while the venue tells customers their balances still display.

Withdrawals are the stress test of that sentence. Binance suspended them on October 29 while checks ran. Deposits, the company clarified on October 30, stayed open. Elliptic’s November 1 update said withdrawals had started to reopen, beginning with bitcoin. The BBC, citing a Binance representative, reported that net withdrawals since transactions resumed came to $4.72 billion. That figure is not in the October 30 notice or the November 3 findings. It is a spokesperson number carried by a newsroom. It is still the number a treasury person should have in the margin, because a venue can be solvent on a spreadsheet and illiquid at the withdrawal window. Narrative is cheap. Exit liquidity is not.

The document that would settle “user funds are safe” is a Proof of Reserves snapshot taken after the theft. Binance promised one once remediation is complete, without a date. Elliptic said the company had aimed for Monday, November 2. This desk could not retrieve ratios from the public Proof of Reserves page on November 4, so this article will not invent a bitcoin number. A ratio without a date is a poster. The mechanics, and the ways a clean PDF can still hide a hole, are in our guide on how to read a stablecoin reserve attestation.

In September this desk wrote about a Circle filing with $100 million of Binance-related stock. That number was a stock purchase, not a USDC mint. This week’s number is coins that moved. Teng told CNBC the wallet system and the internal AI tool have been rebuilt and the affected credentials killed. That is a lock change. It is not a reserve ratio, and this desk still cannot print one for customer bitcoin after 18,270 BTC left.