Overview
- The theft, which occurred on Oct. 29, drained roughly $6.3–6.36 billion from Binance hot wallets in about 20 minutes and continued unauthorized transfers for hours.
- The FBI and multiple blockchain‑analytics firms have publicly linked the attack to TraderTraitor, a North Korea‑linked hacking unit, while Pyongyang has denied responsibility.
- Binance’s report says attackers used a tampered developer tool, fake job interviews that delivered malicious code, and an internal AI tool to gain credentials and subvert wallet signing operations.
- Industry partners and exchanges froze roughly $2.85–3.0 billion of the stolen funds and Binance has replenished about 95–98% of affected assets with company reserves while restoring withdrawals in phases.
- Tracing firms describe highly automated laundering across roughly 12,000 wallets and 11 blockchains with more than 40,000 transactions, a process that created sharp market dislocations and will complicate full recovery and future security reforms.