The $6.3 billion theft from Binance on Oct. 29 is the largest cryptocurrency heist on record. In the days since, security groups, on-chain investigators and insurers have each released new details that, taken together, show how the attack unfolded and what has happened to the money.

🚨 NORTH KOREA-LINKED HACKERS MAY HAVE INFILTRATED BINANCE 8 WEEKS BEFORE THE $6.3 BILLION HACK. According to cybersecurity group SEAL, attackers may have gained access to Binance's internal systems as early as September. The attack reportedly involved fake job interviews,… — Nehal (@nehalzzzz1) November 6, 2026

https://x.com/nehalzzzz1/status/2118731305768906983?ref_src=twsrc%5Etfw

Fake Recruiters and an Eight-Week Window

Security Alliance, a nonprofit cybersecurity group known as SEAL, said North Korea-linked hackers compromised a Binance software engineer's device in September. According to the group, the intruders used a fake recruitment scheme to get in, and it estimates the intrusion window at roughly eight weeks before the exploit.

How the Attack Unfolded

Binance has given a longer timeline. A spokesperson said the first device compromises occurred in June and September, although the attackers did not obtain the access needed to reach wallet operations until Oct. 20. SEAL noted that its eight-week figure covers only the September-to-October period and does not extend to the start of the wider campaign that the exchange described.

The June breach began when a different employee downloaded a tampered Homebrew installation while attempting to set up an AI coding tool. Binance detected the incident, replaced the device and rotated the related credentials, but by then the attackers had already collected information about staff working on wallet infrastructure.

On Oct. 20, the attackers used the engineer's compromised computer and an internal AI tool to take control of the devices of two wallet infrastructure engineers. They then located a deployment permission token, which was used in the Oct. 29 exploit.

SEAL identified at least four front companies tied to the fake recruitment campaigns in 2026: citalab.net, citalab.com, bitfit.io and oddium.io. The group said similar multi-stage patterns appeared in other thefts. It estimates the attackers held about six weeks of access ahead of the $388 million Bitget hack, roughly six weeks of access to LayerZero before the flaw behind the $293 million Kelp DAO exploit, and about three weeks before the $24 million AFX exploit.

The FBI attributed the attack to North Korea's TraderTraitor group. Kim Yo Jong, sister of North Korean leader Kim Jong Un, dismissed the accusation.

Frozen Funds and Market Reaction

Sentora, a DeFi analytics firm, described the response as the largest coordinated on-chain asset freeze in DeFi history. Circle blocked 823 million USDC in a single wallet before the attacker could move it. Ripple froze about $40 million in RLUSD, and World Liberty Financial froze $27 million in USD1 along with 48 million WLFI tokens. The stablecoin freezes alone total roughly $890 million. Bitcoin and Ether have no issuer capable of blocking funds this way; Sentora found 18,270 BTC and more than 420,000 ETH among the attacker's holdings after containment.

DeFi lending markets saw $1.59 billion in net outflows in a single day, about 3% of total value locked. Roughly 60% of that money returned within three days, and Sentora found no bad debt in the markets it assessed. By comparison, the Kelp DAO exploit in April triggered $10.9 billion in withdrawals over five days, about 21% of lending value locked, none of which returned during that window. Sentora attributed the difference to where the damaged assets sat: Binance's loss stayed at the exchange, while Kelp's asset served as collateral across lending markets.

Elliptic said about 1,650 BTC, worth $124 million, had been converted from other stolen assets as of Nov. 6, almost double the previous day's figure. Most of the growth came from XRP swapped through THORChain. The original 18,270 BTC remained untouched across 19 addresses. The analytics firm counted more than 20,000 wallets and 65,000 transactions across 16 blockchains, with about $3.11 billion still sitting in theft-linked addresses.

Binance Restores Most Affected Assets

Binance said on Nov. 4 that it had replaced about 98% of the affected assets using company resources. The remaining 2% involves less liquid tokens, which it is buying through market and over-the-counter channels. On Nov. 5, it asked Arbitrum's DAO to approve the return of 8,425.997 ETH and 74,559,805.2 ARB, a process it expects to take about 49 days. Those two items — the buyback and the DAO approval — remain the outstanding pieces of the replacement effort.

Insurers Take a Closer Look

Reuters reported on Friday that insurers are questioning crypto clients more closely. Marsh's Jacqueline Quintal does not expect material changes in pricing, coverage or capacity, though insurers may ask clients to fix vulnerabilities, and many policies exclude state-backed attacks — a relevant exclusion given the FBI's attribution of this theft to North Korea's TraderTraitor group.

This article originally appeared on CoinCentral.