Pinned post
North Korea Stole $6.34 Billion from Binance in 20 Minutes. Here's What's Left.
A fake job interview just cost Binance $6.34 billion. On October 29, malware planted on an engineer's device during a sham recruitment call gave North Korean group TraderTraitor access to hot wallets across 10 blockchains. The drain took roughly 20 minutes. Chainalysis confirmed the attribution on November 3, calling it the group's most sophisticated operation to date.
🏦 The largest exchange hack on record
The number dwarfs every previous breach. The Bybit attack from February 2025 was $1.5 billion and was itself considered catastrophic at the time. This is four times that. Cointelegraph first reported unusual wallet movements on October 29 as they were still happening, and by the time Binance co-CEO Richard Teng issued a public statement, Bitcoin, XRP and tokens across a dozen networks were already gone.
Teng said Sunday that 95% of affected tokens have been replenished, with 7,500 BTC deployed from SAFU alongside corporate reserves. SAFU, Binance's self-insurance fund, was seeded years ago precisely for a scenario like this. Whether it was sized for one this large is a different question. Binance has not disclosed the current SAFU balance.
🔍 Where the money is now
Of the $6.34 billion stolen, approximately $2.85 billion has been frozen or seized as of November 3, per CNBC. That leaves roughly $3.49 billion still moving. Elliptic tracked the first documented CoinJoin mixing of stolen Bitcoin on November 1 and 2, covering 28 BTC across 18 transactions, about $2.2 million, a small fraction but a signal that laundering infrastructure is active. Stolen XRP moved for the first time on November 2, Elliptic noted.
DeFiLlama recorded $2.57 billion in net outflows from Binance on November 2 alone. Users pulling funds from an exchange mid-crisis is predictable, but that volume in a single day adds pressure on reserves even as Binance insists withdrawals are processing normally.
💻 The vector that made it possible
The initial breach came through a fake recruiter approach targeting a Binance engineer, a technique TraderTraitor has used against crypto firms since at least 2022, according to the Chainalysis blog. The malware gave attackers credentials sufficient to access hot wallet infrastructure across multiple chains simultaneously. That's the part that separates this from prior hacks. Getting into one chain's hot wallet is damaging. Getting into ten at once, in 20 minutes, is an operational failure at a different scale.
South Korean and U.S. officials have both previously attributed TraderTraitor attacks to the Lazarus Group, operating under direction from Pyongyang. No formal government attribution for the October 29 attack has been issued as of this writing.
▪️Tickers: bitcoin:native ripple:native
A fake job interview just cost Binance $6.34 billion. On October 29, malware planted on an engineer's device during a sham recruitment call gave North Korean group TraderTraitor access to hot wallets across 10 blockchains. The drain took roughly 20 minutes. Chainalysis confirmed the attribution on November 3, calling it the group's most sophisticated operation to date.
🏦 The largest exchange hack on record
The number dwarfs every previous breach. The Bybit attack from February 2025 was $1.5 billion and was itself considered catastrophic at the time. This is four times that. Cointelegraph first reported unusual wallet movements on October 29 as they were still happening, and by the time Binance co-CEO Richard Teng issued a public statement, Bitcoin, XRP and tokens across a dozen networks were already gone.
Teng said Sunday that 95% of affected tokens have been replenished, with 7,500 BTC deployed from SAFU alongside corporate reserves. SAFU, Binance's self-insurance fund, was seeded years ago precisely for a scenario like this. Whether it was sized for one this large is a different question. Binance has not disclosed the current SAFU balance.
🔍 Where the money is now
Of the $6.34 billion stolen, approximately $2.85 billion has been frozen or seized as of November 3, per CNBC. That leaves roughly $3.49 billion still moving. Elliptic tracked the first documented CoinJoin mixing of stolen Bitcoin on November 1 and 2, covering 28 BTC across 18 transactions, about $2.2 million, a small fraction but a signal that laundering infrastructure is active. Stolen XRP moved for the first time on November 2, Elliptic noted.
DeFiLlama recorded $2.57 billion in net outflows from Binance on November 2 alone. Users pulling funds from an exchange mid-crisis is predictable, but that volume in a single day adds pressure on reserves even as Binance insists withdrawals are processing normally.
💻 The vector that made it possible
The initial breach came through a fake recruiter approach targeting a Binance engineer, a technique TraderTraitor has used against crypto firms since at least 2022, according to the Chainalysis blog. The malware gave attackers credentials sufficient to access hot wallet infrastructure across multiple chains simultaneously. That's the part that separates this from prior hacks. Getting into one chain's hot wallet is damaging. Getting into ten at once, in 20 minutes, is an operational failure at a different scale.
South Korean and U.S. officials have both previously attributed TraderTraitor attacks to the Lazarus Group, operating under direction from Pyongyang. No formal government attribution for the October 29 attack has been issued as of this writing.
▪️Tickers: bitcoin:native ripple:native
