Picture this: you run the world’s biggest crypto exchange, and in the time it takes to order a pizza, $6.3 billion walks out the door. That’s what happened to Binance on 29 October 2026. The money didn’t vanish in one lucky click. It took months of quiet work, a fake job interview, and a poisoned download — and the whole story is a warning for anyone who keeps crypto anywhere, on any exchange.
The Binance hack is now the largest crypto theft on record. Bigger than anything before it, and the details are stranger than most heists you’ll read about. Here’s what actually happened, who the FBI says did it, and what it means for your own money.
What happened on 29 October
Binance says its hot wallets — the internet-connected wallets that handle everyday withdrawals — were compromised at about 20:05 UTC on 29 October. Hot wallets are the tills of a crypto exchange. They hold enough to pay out withdrawals, and they stay online by design.
The first move was fast. Attackers pulled 233.46 million XRP from five Binance hot wallets into an address they controlled in just four minutes. Then they kept going: bitcoin and other coins followed, across ten different blockchains. The most intense phase lasted roughly 20 minutes. The final unauthorised transfer landed at 23:56 GMT, nearly four hours after the attack began.
Total damage: about $6.3 billion in tokens, or $6.34 billion by Binance’s own count. For scale, the previous record was the Bybit theft of February 2025 — $1.5 billion. This one was more than four times bigger.
One thing worth noting straight away: Binance says it found no evidence of a private-key leak. The thieves didn’t crack the vault. They walked in through the side door, using access that had been quietly built up over months.
The break-in started months earlier
This is the part most people miss. The theft took 20 minutes. The break-in took four months.
It started in June 2026. An engineer on Binance’s wallet team downloaded a tool from the internet that hackers had tampered with. Nothing dramatic happened that day. The poisoned software just sat there, waiting.
Then came September, and the part that reads like a film plot. A second engineer was job-hunting. The attackers posed as a hiring company, ran a fake interview process — the engineer even met the “CEO” of the fictitious firm on a video call — and at the end, asked them to download an “assignment”. That assignment was a malicious code repository. Once installed, the malware replaced a tool on the engineer’s computer and gave the attackers backdoor access.
On 20 October, the attackers used that compromised computer — and abused one of Binance’s own internal AI tools — to take control of the first engineer’s machine and a third engineer’s computer too. On the first engineer’s machine they found a container deployment permission token. That’s the kind of credential that lets you spin up software inside a company’s systems.
Nine days later, they used it. Between 17:15 and 19:56 on 29 October, the attacker logged onto the third engineer’s computer, used the stolen credentials, deployed a container, and triggered the script that drained the wallets.
Think about that chain for a second. A tampered download in June. A fake interview in September. A hijacked AI tool in October. None of those steps, on its own, looks like a $6.3 billion heist. Together, they were.
Who the FBI says did it — and who disagrees
On 31 October, the FBI published an alert attributing the theft to North Korea. The bureau calls this strand of North Korean hacking “TraderTraitor”, the same group it blamed for the $1.5 billion Bybit hack in 2025.
The FBI, working with the US Secret Service and IRS Criminal Investigation, said it had watched the stolen assets being converted mainly into Ether, and expected the money to be laundered further through decentralised finance platforms and instant swap services. It published 628 wallet addresses — 608 on Ethereum, 19 on Bitcoin, one on Solana — and urged exchanges, DeFi services and other crypto firms to block transactions linked to them.
Blockchain analysts had reached the same conclusion a day earlier. TRM Labs and Chainalysis both pointed at North Korea within 24 hours of the theft, noting patterns that matched earlier heists: small withdrawals funding an operator wallet, staging that began well before the attack, and signatures collected in advance, then executed in one burst.
Not everyone agrees — at least not in public. North Korea’s Kim Yo-jong called the FBI’s probe a “political provocation” and said Pyongyang was closely monitoring the situation. And on 31 October, President Donald Trump said investigators did not yet know whether North Korea was involved, despite the FBI’s public attribution.
So the attribution is contested, but it hasn’t been withdrawn. The FBI’s alert stands, and the 628 addresses are still the ones every exchange is being asked to watch.
Where the money went — and how much came back
Here’s the part that surprises most people: a lot of the money didn’t get away.
By 2 November, about $2.85 billion — roughly 44% of what was stolen — had been frozen or seized, according to blockchain firm Elliptic. Binance coordinated with other crypto companies to freeze funds, and stablecoin issuers were able to freeze billions in affected assets.
Binance also moved fast to cover the hole. The exchange said it had replenished about 90% of the affected assets by 31 October, 95% by 2 November, and 98% by 4 November, using its own reserves. It has said repeatedly that users will not bear the loss.
Withdrawals came back in phases. The first batch of networks reopened at 06:00 UTC on 1 November, and more followed on 3 November. And then something interesting happened: users withdrew $3.6 billion after services resumed. People didn’t wait around to see how the story ended — they moved their money.
That rush is understandable. But it’s also worth remembering what Binance says it did with the rest: closed the entry points, rebuilt or replaced the affected systems, tightened device controls, and expanded AI-based anomaly detection. The exchange also says it detected and blocked 57 suspected North Korea-linked cyberattacks during 2026 alone. The one that got through was the 58th.
Why the Binance hack is different
Crypto exchanges have been hacked before. What makes the Binance hack stand out isn’t just the size — it’s the method.
First, the patience. Four months from first foothold to final theft, with each step small enough to avoid tripping alarms. This wasn’t a smash-and-grab. It was a slow build.
Second, the human trick. The fake job interview is the detail that should worry every professional in tech. A talented engineer, doing something completely normal — interviewing for a new role — downloaded the malware themselves. No phishing link in a spam folder. No dodgy attachment from a stranger. A hiring process, with a video call, from a company that didn’t exist.
Third, the AI angle. The attackers didn’t just compromise computers; they abused one of Binance’s own internal AI tools to move between machines. AI tools are now part of the attack surface, not just part of the defence.
And fourth, the scale of the response. Freezing $2.85 billion in days, and covering 98% of the loss from reserves, is something only the biggest exchange in the world could do. A smaller exchange hit like this might not have survived the week.
What it means for your crypto
You don’t need to be a Binance user to take something from this. The same tricks that worked on a billion-dollar exchange work on ordinary people every day — just at a smaller scale.
Start with the obvious one: don’t leave more on an exchange than you need for trading. An exchange is a shop counter, not a safe. If you’re holding crypto long-term, a hardware wallet — one that stays offline — is still the safest place for it. The Binance hack is a reminder that even the biggest exchange is a single point of failure.
Next, treat job offers and “assignments” with the same suspicion you’d give a random email attachment. If a recruiter you’ve never met asks you to download and run code, stop. Real companies don’t hire through executable files. The fake-interview trick worked because it felt normal — a video call, a friendly CEO, a small task. That’s exactly why it worked.
And keep your own defences boring but solid. Two-factor authentication on every account that holds money. Unique passwords, stored in a password manager rather than reused. Software downloaded only from official sources. None of this is exciting. All of it is the difference between a bad day and a disaster.
One more thing: watch for the scams that follow a big hack. After the Binance theft, scammers started circling anxious users with fake “recovery” offers and support messages. If someone contacts you claiming they can get your crypto back, they can’t — they’re the next thief in line.
If you want a deeper look at how these human-targeted tricks work, our guide to AI social engineering breaks down the same playbook at a personal scale. Spear phishing uses the same idea — a message that knows your name and your context — and if an account of yours ever does get compromised, our first-hour hacked-email checklist is the order to do things in.
Frequently Asked Questions
How much was stolen in the Binance hack?
About $6.3 billion in cryptocurrency, or $6.34 billion by Binance’s count. It is the largest crypto theft on record — more than four times the $1.5 billion Bybit hack of February 2025.
Who hacked Binance?
The FBI attributes the theft to North Korea’s TraderTraitor group, in an alert published on 31 October 2026. North Korea has denied involvement, calling the probe a “political provocation”. The FBI has not withdrawn its attribution.
Did Binance users lose their money?
Binance says no. The exchange covered the loss from its own reserves — 98% of the affected assets had been replenished by 4 November — and about $2.85 billion of the stolen funds was frozen or seized. Withdrawals resumed in phases from 1 November.
How did the hackers get in?
According to Binance’s initial incident report, the attack began in June 2026 with a tampered software download, continued in September with a fake job interview that tricked an engineer into installing malware, and used an internal AI tool on 20 October to take over more machines before draining the hot wallets on 29 October.
Is my crypto safe on an exchange?
No exchange is risk-free — even the largest one was breached. Keep only what you need for trading on an exchange, and store long-term holdings in a hardware wallet that stays offline. Turn on two-factor authentication everywhere, and never download software a stranger sends you, even if they claim to be hiring.
The takeaway
The Binance hack didn’t happen because someone forgot a password. It happened because patient attackers chained together small, ordinary-looking steps — a download, an interview, a hijacked tool — until they were standing inside the vault.
That’s the real lesson. Security isn’t one big wall. It’s a hundred small habits, and the attackers only need one of them to fail. Check the download. Question the interview. Keep most of your crypto offline. And when the next record-breaking hack makes headlines, ask yourself what step in the chain you would have caught — then go and make sure that step is actually in place.
For the full official account, read the FBI’s alert on the attack: North Korea Responsible for $6 Billion+ Binance Attack.