Binance Loses $6.34 Billion in Sophisticated Hack, Recovers 98% of Stolen Tokens

Details of the Binance Crypto Exchange Breach

According to НВ — Техно: On November 4, Binance revealed that it had suffered a massive security breach resulting in the theft of approximately $6.34 billion in digital assets. The complex cyberattack began with a fake job interview and exploited an internal AI tool to gain control over wallets. By October 31, Binance had managed to recover 98% of the compromised tokens, though around $2.85 billion remain frozen or seized.

The attacker infiltrated Binance’s systems in September through a fraudulent recruitment process. A fake recruiter conducted video interviews and distributed a repository containing malware. Earlier, in June, a company engineer had unknowingly installed a counterfeit version of Homebrew software, which was instrumental in facilitating the breach. On October 20, the hacker obtained a container deployment token via the internal AI tool, and between 17:15 and 19:56 on October 29, a container was deployed to launch the attack. This led to five hot wallets transferring 233.46 million XRP to the attacker’s address.

Binance’s Response and Security Enhancements

In 2024, Binance has proactively blocked 57 suspected threats linked to North Korea. Following the breach, the exchange restored affected wallet systems and its AI tools, replaced compromised devices, decommissioned related credentials and tokens, scanned employee hardware, and enhanced AI-driven anomaly detection.

Cybersecurity experts at TRM Labs attribute the attack to the North Korean-linked hacking group TraderTraitor. Binance representatives emphasized that

"this was a multi-stage campaign rather than an isolated incident"

and noted their findings are

"based on reliable intelligence sources, both online and offline."

The FBI has also identified TraderTraitor as responsible for a $1.5 billion hack of the Bybit exchange in February 2025, highlighting similarities between these incidents and prior North Korean cybercrimes.

This event highlights the escalating threat posed by state-sponsored cybercriminal groups like TraderTraitor, whose increasingly sophisticated tactics endanger not only Binance’s reputation but the broader cryptocurrency sector. As cryptocurrencies continue to grow in global economic significance, robust security measures remain essential to safeguarding digital assets and maintaining trust in exchange platforms.

As the cryptocurrency landscape faces increasing security challenges, recent incidents highlight the vulnerabilities within digital asset management. For instance, data breaches affecting major wallet manufacturers have prompted significant device destruction, raising concerns about the overall safety of crypto storage solutions. Understanding these developments is crucial for users and investors alike.