Binance Blocked 57 Suspected North Korea-Linked Attacks in 2026

Fake Interviews and Malicious Developer Tools

Binance co-founder and co-CEO Yi He said on Nov. 3 that the exchange's security team has detected and blocked 57 suspected North Korea-linked cyber attacks since the start of 2026. In a post on X, she described the attempted intrusions as reflecting a persistent threat from state-funded actors, and wrote that the team intercepted many of them, but the cost of failing to stop even one had been severe. Her comments accompanied the exchange's initial findings into the Oct. 29 breach, published the same day.

According to that report, a software engineer was approached in September through a legitimate job-hunting platform by someone posing as a project director. A purported human resources representative then ran a video interview, supported by a social media profile containing personal photos and videos, before a second interviewer presenting himself as the chief executive of a fictitious company instructed the engineer to download a work assignment onto a work computer. Malicious code inside the assignment executed during setup and escaped detection by the endpoint security tools in use. On Oct. 20, the attacker used the compromised machine and an internal AI tool to reach two wallet engineers, obtaining credentials that enabled access to wallet signing operations, where private key material authorizes asset transfers. Earlier wallet authorization findings traced part of the theft to Binance 14, an Ethereum hot wallet, after security review identified 50 submitted EIP-7702 authorizations, one of which successfully delegated execution rights to a malicious contract. Yi's post did not break down how many of the 57 suspected cases involved recruitment lures, though the initial report describes recruitment scams, compromised browser extensions and fake conferencing apps as main lines of attack.

98% Replenishment as the FBI Names TraderTraitor

The Oct. 29 incident affected roughly $6.34 billion in digital assets, and the FBI's Oct. 31 cyber alert attributed the theft to North Korea, identifying the activity as TraderTraitor. Working with the US Secret Service and IRS Criminal Investigation, the bureau said attackers converted the stolen assets primarily into Ether and expected further laundering through decentralized finance and instant swap services, a category that includes routing protocols such as the 0x Protocol. The agencies urged exchanges, analytics firms and infrastructure operators to block transactions involving the listed addresses. North Korea denied involvement on Nov. 3, with Kim Yo Jong rejecting the accusation in a statement carried by state media.

In its Nov. 3 report, Binance said 98% of the impacted token assets had been replenished and that it was still purchasing the remaining, less liquid assets, with more funds set aside than the loss required. The exchange identified BTC, ETH, USDT, BNB, SOL, XRP, USD1, RLUSD and ZEC as fully backed, along with USDC, the stablecoin issued by Circle. Replacement purchases have drawn on the Secure Asset Fund for Users, excess reserves from the Futures Insurance Fund and the company's corporate treasury. Withdrawals have returned asset by asset: Bitcoin withdrawals reopened on Nov. 1, when CEO Richard Teng put replenishment at approximately 95%, and on Nov. 3 the exchange restored withdrawals for 31 additional assets on Ethereum and 20 on Solana, following the reopening of five Ethereum stablecoins. On-chain tracing data shows roughly 28 BTC, worth $2.2 million, entered 18 CoinJoin transactions between Nov. 1 and early Nov. 2, while the 18,270 BTC taken directly from the exchange remained in 19 addresses at that assessment. Theft-linked addresses still held an estimated $3.24 billion, mainly in Ethereum and Bitcoin, across a review spanning about 12,000 wallets and 11 blockchains.

The contrast between 57 blocked attempts and one successful breach is the sharpest fact in the disclosure. Attackers did not need to defeat the exchange's perimeter: a single engineer's work computer, reached through a fake interview, gave them a path to wallet engineers and signing credentials within a month. That makes recruitment pipelines and developer toolchains a counterparty risk every platform now has to price in, not an internal security footnote. The laundering pattern points the same direction: with roughly $2.85 billion frozen or intercepted, about $3.24 billion still sitting in theft-linked addresses and stolen BTC already moving through CoinJoin mixes, the realistic recovery ceiling is set, and the exchange's remaining exposure sits in the illiquid token tail it is still buying back.