Binance disclosed that North Korean hackers posed as job recruiters to contact a wallet-team engineer, then convinced them to download a malicious 'coding assignment' that bypassed the company's security tools. The initial breach let attackers pivot through an internal tool to compromise two more engineers' machines, eventually gaining access to systems controlling billions in crypto assets, resulting in a record $6.3 billion theft.
techcrunch.com
· 2026-11-03
Binance co-CEO Richard Teng said attackers spent months infiltrating the exchange's systems, starting in June with a fake developer tool that compromised an engineer's device, followed by sham job interviews in September that delivered hidden malware. The intruders then moved through Binance's internal AI tools to gain access to wallet transaction authorization, resulting in the Oct. 29 theft of more than $6.3 billion in assets. Teng said Binance has restored 98% of the affected funds and is still buying back remaining illiquid assets.
cnbc.com
· 2026-11-03
Binance published an incident report attributing its October 29 theft of roughly $6.34 billion in crypto to North Korean state-linked hackers tracked as TraderTraitor/Lazarus Group. The exchange says an engineer was lured via a fake recruiter on a legitimate job platform, underwent staged interviews, and was tricked into downloading a malicious coding assignment that installed custom malware, eventually compromising Binance's wallet infrastructure. The FBI has also attributed the attack to the same North Korean group.
bleepingcomputer.com
· 2026-11-03
Security firms and law enforcement are attempting to trace and recover more than $6.3 billion in cryptocurrency stolen from Binance, with TRM Labs and Chainalysis attributing the breach to North Korean hacking group TraderTraitor. Binance says it will cover user losses through its Secure Asset Fund for Users, while stablecoin issuers Circle and Tether have frozen roughly $3 billion of the stolen funds.
cnbc.com
· 2026-10-30
Security researchers have attributed a record-breaking crypto heist at Binance to hackers tied to North Korea, with at least $6.3 billion stolen from the exchange's wallets. Binance says roughly half of the stolen funds were frozen as they moved across blockchains, and the company has suspended all deposits and withdrawals while it investigates. Binance said the breach began when attackers compromised an engineer's laptop, gaining access to a service container to submit unauthorized withdrawal transactions, though it says there is no evidence its private keys were exposed.
techcrunch.com
· 2026-10-30
Binance, the world's largest cryptocurrency exchange, has frozen withdrawals after attackers stole roughly $5.6 billion across multiple cryptocurrencies including Tether, Bitcoin, Ethereum and Circle dollars. Security firm TRM has attributed the breach to TraderTraitor, a North Korean state-linked hacking group also blamed for last year's $1.5 billion Bybit hack. Binance says it initially traced the breach to a compromised laptop but has since found additional entry points, and insists user funds remain safe and losses will be covered.
tomshardware.com
· 2026-10-30
Binance suffered a cyberattack on October 29 that drained roughly $6.36 billion across ten blockchains, according to blockchain intelligence firm TRM Labs, which said most funds moved within about 20 minutes. The exchange suspended withdrawals, later saying it had frozen about $3 billion of the stolen assets with partners' help and would cover all customer losses, with withdrawals expected to resume within a day or two. Binance initially blamed a compromised DevOps engineer's laptop but has since said investigators found additional breach points, calling it a complex attack.
techspot.com
· 2026-10-30
Binance said attackers gained access to a DevOps engineer's compromised laptop and used it to reach a service container, enabling them to submit unauthorized withdrawal transactions. Co-CEO Richard Teng said the attack was more complex than a single engineer's permissions being exploited, and the company has not attributed blame to any individual. Binance has suspended deposits and withdrawals, revoked authorizations for the affected address, and says it will cover losses via its SAFU fund and company reserves.
bleepingcomputer.com
· 2026-10-30
Kaspersky researchers identified a Lazarus Group operation, dubbed FlashHole, that uses the ML-KEM-1024 post-quantum cryptographic standard to secure communications between malware and its command-and-control servers. The campaign, active since July 2025, uses phishing pages linked to crafted GitHub sites to trigger a multi-stage infection chain involving tools like LPEClient, TechHub, and ClientHub, with at least three South Korean firms in software, construction, and telecom equipment confirmed as targets.
bleepingcomputer.com
· 2026-10-21
Bitget has reopened Bitcoin withdrawals after suspending them following a breach it says North Korean hackers carried out last week, stealing $387.5 million across multiple chains and tokens. The exchange plans to phase back withdrawals for ETH, USDT and other assets by early October, saying it has fixed the exploited vulnerability and that user balances remain unaffected thanks to its Protection Fund.
bleepingcomputer.com
· 2026-09-28
Cryptocurrency exchange Bitget said hackers stole more than $351 million from its hot wallets in a Thursday cyberattack, making it the largest crypto theft of the year. The exchange has suspended withdrawals and said its $464 million user protection fund should cover losses, though CEO Gracy Chen did not give a timeline for restoring withdrawals.
techcrunch.com
· 2026-09-25
Bitget said suspected North Korean hackers stole roughly $351.6 million from its hot and warm wallets after unauthorized transfers were flagged Thursday evening. The exchange has paused withdrawals and enlisted Mandiant and SlowMist to investigate, while saying its cold wallets, self-custodial wallet product, and customer balances remain unaffected.
bleepingcomputer.com
· 2026-09-25
GoKawiil