Binance prevented 57 suspected North Korea-linked cyber threats during 2026, but a fraudulent recruitment scam still helped attackers steal USD 6.34 billion in cryptocurrency on October 29. The exchange's November 3 security report details how compromised developer computers and stolen permissions enabled the breach.
Binance stated that its security team intercepted 57 suspected North Korean operations involving malicious software, fake interviews, and credential theft. Yi He, Binance's co-CEO, acknowledged the failure: “We intercepted many of them, but the cost of failing to stop even one was severe and this should never have happened.”
The exchange has not specified how many blocked attempts involved recruitment fraud or whether they originated from the attackers responsible for October's theft.
In June, a wallet infrastructure engineer downloaded a modified Homebrew installer while installing an AI coding tool. Binance detected the intrusion, replaced the computer and reset credentials, but attackers obtained information about employee responsibilities.
In September, another engineer encountered a supposed recruiter on an employment platform. After video interviews with individuals impersonating company executives, the employee downloaded a coding assignment containing malware.
Binance said that the malicious repository bypassed endpoint protection and connected the computer to attacker-controlled infrastructure.
By October 20, attackers had exploited the infected computer and an internal AI tool to access two engineers' systems. They subsequently obtained deployment permissions. On October 29, stolen credentials enabled deployment of a malicious container targeting wallet-signing infrastructure.
Unauthorized transfers followed across multiple blockchain networks, outside normal withdrawal procedures. The FBI attributed the incident to North Korea's TraderTraitor operation on October 31. North Korea has denied responsibility.
Following the breach, Binance revoked exposed credentials, replaced affected devices and rebuilt compromised wallet systems. It also expanded AI-based behavioral monitoring and strengthened developer protections.
The incident shows that detecting dozens of threats does not eliminate exposure to social engineering. For cryptocurrency platforms, recruitment verification, software integrity, and restricted deployment access remain critical safeguards against attacks.
Also Read: North Korea Rejects Allegations of Record USD 6.3 Billion Binance Crypto Hack