Hackers linked to North Korea pulled off the biggest crypto theft in history, stealing more than $6.3 billion from Binance after tricking an employee with a fake job interview.
Story Snapshot
- The Federal Bureau of Investigation (FBI) says a North Korean hacking group called TraderTraitor stole over $6 billion from Binance on October 29.
- Binance says a fake recruiter posed as a project director and lured an engineer into a staged job interview process.
- The attackers allegedly planted malware inside a coding test, then used stolen credentials to break into Binance’s wallet systems.
- More than 233 million XRP tokens vanished from five Binance wallets in just four minutes.
- North Korea denies any involvement, leaving a public dispute over who is really responsible.
Fake Job Offer Opens the Door
Binance says the scheme began in September, when someone posing as a project director reached out to an engineer through a legitimate job site. The fake recruiter scheduled interviews with supposed company staff, then sent a coding assignment. That assignment reportedly hid malicious code, giving attackers a foothold on the engineer’s computer before anyone suspected a problem.
Once inside, the hackers used stolen login credentials to run a malicious script. That script gave them access to Binance’s wallet-signing service, the system that approves outgoing crypto transactions. This step turned a single compromised laptop into a pathway toward the exchange’s core financial infrastructure.
Billions Gone in Minutes
The theft moved fast once it started. The Globe and Mail reported that attackers drained 233.46 million XRP tokens from five Binance hot wallets in just four minutes, then kept pulling out other digital assets. Binance says the full operation affected roughly $6.34 billion in crypto, making it the largest exchange heist ever recorded.
The Federal Bureau of Investigation (FBI) publicly blamed North Korea for the attack and named TraderTraitor as the group behind it. Yonhap News Agency reported the bureau’s attribution days after the theft, tying the Binance breach to a hacking unit with a long history of targeting cryptocurrency firms.
A Familiar North Korean Playbook
This is not new territory for TraderTraitor. U.S. cybersecurity officials have tracked the group since at least 2020, describing a pattern of spearphishing messages disguised as job recruitment aimed at developers and technical staff. The pitch usually promises high pay, then delivers malware once the target takes the bait. The Binance case fits that pattern closely.
North Korea has built a reputation as one of the world’s most prolific cryptocurrency thieves. Reports note the group previously stole about $1.5 billion from a Dubai-based exchange in February 2025, which stood as the prior record before Binance. Researchers estimate North Korea has stolen well over $6 billion in digital assets through these kinds of operations over the past year alone.
Response and Unresolved Questions
Authorities moved quickly to claw back some of the stolen funds. Reports say roughly $3 billion was frozen before it could be laundered, and Binance has pledged to repay affected customers. Still, the public record does not yet spell out the final net loss after recovery efforts, leaving the true financial damage somewhat unclear.
How do you recover $1.2 billion in stolen cryptocurrency? The FBI’s operation to trace and seize the assets linked to the Binance heist offers a glimpse into the growing sophistication of blockchain investigations—and the evolving battle against crypto crime.#Crypto #Binance… pic.twitter.com/bHbSY7PWAa
— tippinsights (@TippInsightsHQ) November 13, 2026
North Korea has rejected the FBI’s allegation, creating a dispute that remains unresolved in public view. The government has not released the underlying technical evidence behind its attribution, such as malware samples or forensic logs, though intelligence tied to foreign state actors is often kept confidential for national security reasons.
The Binance breach lands at a moment when Americans across the political spectrum already distrust large institutions, whether banks, exchanges, or government agencies, to protect their money. A $6 billion theft pulled off through a fake job interview shows how easily trust and routine hiring practices can be turned into a weapon against even the biggest players in finance.
Sources:
nbcnews.com, nextgov.com, uk.finance.yahoo.com, hcamag.com
