Binance’s $6.3B Hack: Inside the DPRK’s Attack and Crypto Laundering Operation

A $6.34 billion heist of Binance involved a fake job interview, where a software engineer at the company was convinced to download an “assignment” containing a malicious code repository onto his work computer.

News of the hack first emerged late last week, leaving many wondering how threat actors pulled off what’s stacking up to be the largest recorded cryptocurrency hack of all time (far surpassing the 2025 Bybit attack where attackers left with $1.46 billion). In a Tuesday security incident update, the cryptocurrency exchange said the hack was the result of a “sophisticated, multi-stage campaign,” starting back in June 2026. The FBI has attributed the attack to DPRK actors. 

“It was not a single isolated breach or a simple phishing incident,” according to Binance on Tuesday. “The attackers combined a range of techniques, including social engineering by fake recruitment interviews, malicious software downloads, compromised internal AI tooling, endpoint compromise, and an advanced transaction-authorisation method.”

The Beginnings of the Binance Attack

According to Binance, the attack started when a DevOps engineer downloaded a fake, malicious Homebrew installation (open-source package manager for macOS and Linux that lets users easily install, update, and manage software and developer tools from the command line). While Binance’s security team detected the download and contained the incident at the time, the engineer’s role and related colleagues on the infrastructure team were “exposed”.

Then in September, a software engineer was contacted via a legitimate job-hunting platform by an attacker pretending to be a project director. The social engineering ploy was in depth, including a first-round live video interview with an “HR representative” (who also sent the target a fake social media account with personal photos and videos on it to build trust) and a second-round interview with the “CEO” of the fake company via a social chat app. At the end of this interview, the engineer was instructed to download an “assignment” to their work computer, which was actually a malicious code repository. 

“The malware employed sophisticated obfuscation and evasion techniques, including replacing a legitimate development tool component with a malicious version to execute commands and establish communication with an attacker-controlled external server,” said Binance. “The attacker also took steps to conceal the malicious activity and remove traces of the compromise, making detection and subsequent investigation more challenging.”

On Oct. 20, the attackers used the employee’s compromised device to leverage an internal AI tool and gain control over other employees’ systems – including the previously compromised DevOps engineer. That employee had a container deployment permission token on his computer. On Oct. 29, the attackers logged into a separate employee’s computer and used credentials stolen from the DevOps engineer to deploy a container and trigger a malicious script to launch the attack. 

Social Engineering and the Crypto Sector

This was only one attempt of many to compromise Binance’s environment, according to the update. 

“Throughout 2026, Binance’s security team detected and prevented 57 suspected North Korea-linked cyber threat cases,” said Binance. “These attempts reflect the persistent threat posed by state-sponsored actors targeting the cryptocurrency industry. The techniques include fraudulent job interviews, malicious software disguised as popular developer tools, compromised software packages and browser extensions, fake video conferencing applications, and social engineering campaigns designed to steal credentials or deploy remote access malware.”

Many attacks in the cryptocurrency space (typically from DPRK actors) have started with in-depth social engineering schemes, which sometimes involved the attackers getting close with victims, building trust, and waiting patiently for an opportune moment before launching their attack.  

In April 2026, North Korean-linked attackers stole approximately $285 million from Solana-based DeFi platform Drift Protocol after spending six months building relationships with employees while posing as a legitimate trading firm, for instance. They used malicious software disguised as legitimate business tools to compromise contributors and manipulate the platform’s multisignature transaction approval process, ultimately gaining control and draining funds.

Many other cryptocurrency hacks have started with attackers impersonating recruiters or prospective employers on LinkedIn and using fake job interviews or coding assignments to deliver malware (including the Ronin, Rain, and CoinsPad attacks).

The Money Laundering Behind It All

The amount of money attackers have been able to steal from the cryptocurrency sector is almost unfathomable. While the theft of $6.3 billion from Binance is staggering, other attacks in only the last five years have also proved lucrative for attackers, including Bybit ($1.46 billion), Ronin Network ($625 million), and Poly Network ($611 million).

Binance, for its part, said 98 percent of the impacted token assets “have been replenished and are verifiable on our Proof of Reserves page.”

“Approximately USD 6.34 billion in digital assets were impacted by the incident,” said Binance. “As of this update, approximately USD 2.85 billion in digital assets have been frozen or intercepted, subject to reconciliation and market price volatility.”

The FBI said that it expects DPRK actors to launder the stolen funds. It released cryptocurrency wallet addresses that are holding or have held assets from the theft, and are operated by the DPRK attackers. It urged private sector entities (including virtual asset service providers like RPC node operators, instant exchanges, DeFi services, and blockchain analytics firms) to block transactions derived from these addresses.

“The FBI, together with partners at the USSS and IRS-CI, has observed TraderTraitor actors converting stolen assets primarily into Ether (ETH),” according to the FBI. “It is expected these assets will then be further laundered by converting them using DeFi and instant swap services as they prepare them for further laundering stages.”

In a Nov. 3 analysis, blockchain analytics firm Elliptic said the laundering is “highly complex and clearly automated.” 

“In its first three and a half days it used about 12,000 wallets across 11 blockchains, roughly one new wallet every 25 seconds, and more than 40,000 transactions,” according to Tom Robinson, chief scientist and co-founder with Elliptic in the analysis. “Around $3.18 billion remains in addresses linked to the theft, mostly as ETH and BTC… A negligible amount has likely been cashed out so far. Most of what has happened is conversion: the funds have changed asset, but remain on public blockchains in addresses linked to the theft.”

Interestingly, the Binance laundering has been slower than the laundering linked to the Bybit hack in February 2025, where North Korea laundered all 499,000 stolen ETH within ten days (cashing out then took months). 

“The sums are more than twice those stolen from Bybit, and moving them quickly would mean large losses on swaps,” according to Robinson. “And with the attacker’s addresses published by the FBI, services are watching. We expect the ETH to be swapped for bitcoin in many small transactions, and then cashed out through OTC brokers over a period of months. The SOL conversions since November 2 follow this pattern on a small scale.”