But hidden inside the assignment files was malicious software. The moment the engineer downloaded and ran it on his work computer, the attackers gained a door into the company's systems. The software used advanced concealment techniques and even replaced a legitimate component in a development tool with a malicious one, allowing it to execute commands and communicate with servers controlled by the hackers.
The investigation revealed, however, that this was not the first time the attackers had managed to get close to the company's infrastructure. As early as June, another engineer's computer was infected after he downloaded a manipulated version of a popular software tool. Binance's security team identified the unusual activity, replaced the computer and reset access credentials, but the attackers had already gathered information about the employee and his colleagues who were involved in the digital wallet infrastructure.
On October 20, the operation moved to the next stage. The hackers exploited the breached computer and Binance's internal AI tool to reach the computers of two additional engineers who were involved in developing and operating the digital wallet systems. During the intrusion, they managed to locate authorization credentials that allowed them to perform advanced operations within the company's systems.
Nine days later came the execution phase. On October 29, the attackers used the access credentials they had stolen, connected to one of the engineers' computers, installed a software component and activated malicious code that granted them access to the transaction-signing system. Within minutes, enormous quantities of cryptocurrency began flowing out of Binance's digital wallets.
According to the report, in just four minutes approximately 233 million XRP tokens were transferred from five of the company's hot wallets. Later, large quantities of Bitcoin, Solana and other coins were also transferred. The attackers exploited an advanced technological mechanism that allowed them to grant a smart contract under their control execution permissions in the wallet, bypassing some of the exchange's standard defense mechanisms.
The total value of assets affected by the attack is estimated at approximately $6.34 billion. Binance managed to freeze or intercept assets worth about $2.85 billion, but the incident is considered one of the most severe cyber cases the cryptocurrency world has ever known.
Alongside the dramatic disclosure, Binance sought to reassure users and announced that the company would bear the full losses and would not pass them on to its customers. According to an update published on November 3, the company had already completed the restoration of approximately 98 percent of the affected assets and had made available resources exceeding the amount needed to cover the losses.
The U.S. FBI attributed the attack to North Korea, and according to reports the hacker group involved is TraderTraitor, which is associated with previous cyber operations by the communist state. Binance noted that during 2026 it identified and thwarted 57 additional attack attempts that were suspected to be linked to North Korean actors.
Following the breach, the company announced it had replaced affected computers, rebuilt the wallet systems and the internal AI tool, revoked exposed permissions and expanded its threat-detection apparatus. In addition, it intends to engage independent cybersecurity experts to examine the failures and develop additional layers of defense.
