Binance Says North Korea Was Behind the Hack That Stole $6.3 Billion in Crypto

Binance has published its preliminary report on the cyberattack that led to the theft of USD 6.3 billion in cryptocurrency. The exchange says the incident involved multiple stages, social engineering, malware, compromised internal tools, and a transaction authorization method that was abused to move funds out of the normal withdrawal flow.

1. Binance said the attack was “a serious and highly sophisticated security incident,” not a single breach or a simple phishing case. According to the report, the attackers combined fake job interviews, malicious software downloads, compromised internal AI tools, endpoint compromise, and an advanced transaction authorization method.
2. The company said the latest information published by the Federal Bureau of Investigation (FBI) indicates that the Democratic People’s Republic of Korea was responsible for the incident. Binance also said the investigation is continuing and that further reviews will be done with independent investigators.
3. One failed initial attack appears to have given the hackers information about Binance’s security setup. The final stage involved creating a fake company that lured a Binance programmer with a supposed job search and got them to install a malicious file.
4. Binance said the attack began when an intruder gained unauthorized access to an internal wallet-signing service and used it to start transfers outside the normal withdrawal circuit. Funds were then moved from five Binance hot wallets to hacker-controlled addresses.
5. The company said it will absorb the financial impact of the theft, not users. As of October 31, 2026, Binance said 98% of the affected token assets had been replaced and can be verified on the Proof of Reserves page, while the remaining lower-liquidity assets are still being acquired. Binance also said USD 2.850 billion in digital assets have been frozen or intercepted, subject to reconciliation and market price volatility.

For high-risk operators and PSPs, the detail that matters is not just the size of the loss, but the mechanics: social engineering got in the door, and an internal signing service helped turn access into movement. That is the kind of failure mode that changes how you think about internal controls, wallet operations, and transaction authorization.