Binance says its security team stopped 57 suspected North Korea-linked cyber threats over the course of 2026, according to Co-CEO Yi He, who disclosed the figure on November 3, 2026.

The disclosure appeared in a detailed incident report published after a breach on October 29 that reportedly drained approximately $6.34 billion in digital assets from the exchange. The tally therefore reads 57 attempts blocked and one that got through — in a line of work where a single miss can carry a ten-figure price tag.

What Binance disclosed

The report describes attack methods that leaned on people as much as on code. Tactics cited include social engineering, tampered software packages, and fake job interviews. In each case, the goal was the same: obtain unauthorized access to sensitive information and plant malware on internal systems.

Binance attributed the October 29 incident to North Korea's TraderTraitor group. The FBI and blockchain analytics firms have also linked the theft to the same unit, according to the research findings.

TraderTraitor is not a new name in crypto security circles. U.S. agencies and security researchers have long tracked the North Korea-linked cluster, which is known for targeting cryptocurrency companies through fabricated job offers and compromised software supply chains. The group has previously been tied to high-profile thefts, including the Bybit hack in February 2025 — one of the largest cryptocurrency thefts on record, in which roughly $1.5 billion in digital assets was stolen. The October 29 breach, at roughly $6.34 billion, is more than four times that figure.

Containment and fallout

After the breach, Binance moved to contain the damage. The exchange froze or intercepted roughly $2.85 billion of the stolen assets. That amounts to under half of the roughly $6.34 billion taken, leaving roughly $3.5 billion outside the reported containment figures.

Binance has pledged to replenish any affected user assets — a commitment that, if honored in full, shifts the loss from customers onto the company's balance sheet.

Withdrawals were paused in the immediate aftermath of the incident. The exchange began restoring them in phases starting November 1, 2026.

North Korea, for its part, rejected the accusations. Kim Yo Jong dismissed the claims of involvement as “absurd rhetoric.”

A campaign, not a one-off

Blockchain analytics firms including TRM Labs, Chainalysis, and Elliptic have described North Korea's activity against the crypto industry as a strategic campaign. According to the research findings, those firms see the effort growing more sophisticated and more urgent.

Cyber theft has become a significant source of revenue for North Korea's weapons programs, according to the research findings.

The volume alone tells a story: 57 suspected cases across a single year works out to more than one serious attempt per week, aimed at a single exchange — underscoring how persistent the attempts have been.

What this means for exchanges and users

Binance's pledge to cover losses is the critical variable for its own customers, determining whether the financial impact of the breach reaches them at all.

The attack methods also matter for the wider industry. Social engineering and fake hiring schemes target employees directly, which means firewalls and audits only go so far. Hiring practices, developer onboarding, and dependency management have become frontline security concerns.

The 57 blocked cases cut both ways as a disclosure. On one hand, they show a security team catching a steady stream of attempts. On the other, they show how relentless the pressure is — and how one success can outweigh dozens of defensive wins.

For users, the lesson is less about any single platform and more about exposure. Funds held on an exchange depend on that exchange's defenses holding every time, against an adversary that only needs to win once.

Key developments to watch include how quickly Binance completes its phased withdrawal restoration, whether more of the stolen assets are frozen or recovered, and how the exchange funds its replenishment pledge.

Source: CryptoBriefing. The original article was edited by John Chen.