Binance said its security team detected and stopped 57 suspected North Korea-linked cyber threat cases in 2026 before a single attack got through — one that used a fake job interview and ultimately drained the exchange's hot wallets, the internet-connected wallets exchanges rely on to process user withdrawals.

In its initial report on the breach, posted on X, Binance said approximately $6.34 billion in digital assets was affected and that about $2.85 billion has been frozen or intercepted. The exchange said it will absorb the losses rather than passing them to users, and that 98% of the impacted token assets have been replenished — a figure it said can be verified on its Proof of Reserves page.

For scale, the largest crypto theft previously on record was the February 2025 breach of exchange Bybit, which involved roughly $1.5 billion and was attributed by Bybit to North Korea-linked hackers.

Citing the latest information from the Federal Bureau of Investigation (FBI), Binance attributed the incident to North Korea.

A Year of Targeted Attempts

According to the exchange, the 57 cases reflect the persistent threat of state-sponsored actors targeting the crypto industry. The techniques observed included fraudulent job interviews, malicious software disguised as popular developer tools, compromised software packages and browser extensions, fake video conferencing apps, and social engineering campaigns designed to steal credentials or deploy remote access malware.

That recruitment-based playbook aligns with public advisories U.S. agencies have issued in recent years warning that North Korean-linked operatives pose as recruiters or employers to infect targets' computers with malware.

Binance described the breach as a multi-stage campaign rather than a single isolated breach or a simple phishing attempt. It traced the first warning sign to June, when a wallet DevOps engineer downloaded a tampered Homebrew installation while searching for an AI coding tool. Binance said it detected the anomaly, replaced the device, and rotated the related credentials — but the engineer's role and his colleagues on the wallet team had already been exposed to the attacker.

How the Interview Worked

In September, a second engineer whose job-platform profile referenced his experience at Binance was approached by someone posing as a project director. A first-round video interview followed with a purported HR representative, who shared a social media account featuring personal photos and videos to build trust. Binance described this as more deceptive than earlier social engineering approaches.

The second round took place on a popular chat app with someone claiming to be the CEO of a fictitious company. Near the end, the engineer was told to download an "assignment" onto his work computer. The code inside ran during setup and opened a channel to an attacker-controlled server. Binance said the zero-day malware was not detected by its endpoint security tools at the time.

The attacker then used the compromised computer and an internal AI tool to gain control over two other wallet engineers. Binance said a container deployment permission token found on one engineer's machine was used on the day of the attack to deploy a container and trigger the malicious script.

Why Containment Took Time

Binance said the attackers used the signing service to exploit Ethereum's EIP-7702 authorization mechanism — an account feature introduced in Ethereum's 2025 Pectra upgrade that lets standard user accounts operate with smart-contract functionality — which kept moving assets even after withdrawals were suspended. Because the hot wallet used multi-party computation (MPC), there was no single private key to revoke the malicious authorizations, so the team built a specialized procedure that took extra time.

The exchange said it has since rebuilt the affected wallet system and internal AI tool, replaced affected devices, decommissioned related credentials, and strengthened its anomaly detection. It also plans an independent security review, and some technical details will remain confidential.

Binance described its report as initial, meaning its findings are still subject to independent review — leaving the outcome of the planned review and any updated loss or recovery figures as the details to follow from here.