Binance details $6.34B multi-stage attack tied to North Korea
Binance says hackers spent months preparing the attack, using a fake Homebrew installer and a sham job interview. The FBI blames North Korea, which denies it.
Binance has published the first details of the cyberattack it disclosed on the night of 30 October 2026, which it puts at roughly $6.34 billion in impact. The exchange says the attack was "multi-stage", prepared over several months and combining different methods.
The company reported a "possible security issue" on 30 October and says it is covering the losses from its own funds. It maintains that user assets are safe. Its investigation is still under way, and the findings have yet to be independently verified.
How the attackers got in
According to Binance, the first step came in June 2026, when an engineer downloaded a fake Homebrew package manager while trying to install a "popular AI coding tool". The security team spotted an anomaly, replaced the device and refreshed the related credentials. By then, however, the attackers had already learned the employee's role and who his colleagues were.
In September, another developer fell for a fake job interview. After two online interviews, the attackers asked him to download a "task" onto his work computer. It contained malicious code, and the attackers also took steps to cover their tracks. Binance says its security team has blocked 57 cyber threats this year that are believed to be linked to North Korea.
The final stage
On 20 October, the hackers used the compromised computer and an internal AI tool to reach the data of two employees, one of whom had the necessary permissions. On the evening of 29 October they connected to a device, used the stolen credentials and ran a malicious script to carry out the attack.
On 31 October, the FBI said North Korea was responsible. Pyongyang called the accusations "absurd rhetoric".
The case shows how a patient social engineering campaign aimed at individual engineers, using fake software and fake hiring, can end in a loss of this scale at a major exchange. Binance has not said when the independent review of its findings will be complete.
Apps worth a look
SUMO: the number puzzleTap the right tiles, add them up, hit the target. Easy to learn, hard to master. Free, for all ages.
Dialo: learn languages by speakingTalk to an AI conversation partner; every sentence comes back corrected and explained in your language. 9 languages, A1 to C2.
ediviewer: read EDI files like documentsOpen EDIFACT and X12 messages, see every segment explained, convert to JSON/XML, export PDF and Excel. Runs locally, no upload.
More from this day
See all →
Naver Speeds Up Unified AI Agent as Kakao, Baemin Expand
Termit Raises Seed Round for AI Commerce Content Agent Creage
MISS A Nears $1 Billion Valuation With First Outside Funding
