Overview of the Incident

On October 29, a coordinated attack on Binance, one of the largest cryptocurrency exchanges globally, resulted in a staggering loss of approximately $6.3 billion. The Associated Press reported this incident as potentially the most significant theft in the cryptocurrency sector to date.

The breach initiated around 4:20 p.m. ET, prompting Binance to suspend withdrawals temporarily to mitigate further losses. According to Chainalysis, a blockchain analytics firm, the rapid execution of the hack raised alarms across the crypto community.

Immediate Response and Recovery Efforts

In the aftermath, Binance reported that approximately $3 billion of the stolen assets had been promptly frozen, thanks to collaborative efforts with other parties in the industry. By November 2, the exchange announced significant strides in restoring user confidence by replenishing most of the affected assets using its own financial resources.

Crucially, Binance assured its users that they would not incur losses as a result of the theft.

How the Attack was Executed

In a report released on November 3, Binance outlined the meticulous planning that went into the attack. The hackers initially approached an engineer via a recruitment platform, successfully deceiving them into downloading a malicious coding assignment as early as September.

By October 20, these intruders had leveraged the compromised computer, alongside an internal AI tool, to further infiltrate the systems of two additional engineers and acquire software deployment permissions.

Ultimately, on October 29, the attackers utilized these stolen credentials to deploy a malicious code and compromise Binance’s wallet signing service. They also exploited Ethereum’s EIP-7702 mechanism, enabling them to continue unauthorized transfers even after Binance had suspended withdrawals.

Binance reported that the total impact of the breach was $6.34 billion, with $2.85 billion either intercepted or frozen shortly after the incident.

Involvement of U.S. Authorities

Following the incident, Binance’s former CEO Changpeng Zhao (CZ) sought assistance from U.S. authorities. In a discussion on November 3, he mentioned learning about the hack while in the United Arab Emirates around midnight. His focus shifted to calming the concerns of the crypto community, rather than directly managing the operational response.

“We would love for them to help us. Myself, Binance as a company, the industry, the crypto industry as a whole, would love to get help from the U.S. government,” Zhao stated during the interview.

Zhao identified the U.S. and China as key players capable of communicating with North Korea, a country suspected of perpetrating the hack. However, it is essential to note that he clarified he had not personally communicated regarding the incident with Donald Trump or his administration.

Accusations Against North Korean Hackers

The FBI linked the Binance breach to North Korea’s TraderTraitor hacking group, which previously engaged in the $1.5 billion Bybit attack in 2025. The agency warned that the hackers were converting stolen assets into Ether and might utilize decentralized finance platforms to facilitate laundering.

In a swift response, North Korea’s government denied these allegations. Kim Yo Jong, the sister of North Korean leader Kim Jong Un, condemned the U.S. accusations as a “grave political provocation,” suggesting ulterior motives behind the U.S. claims without presenting evidence.

Conclusion and Future Implications

The unprecedented scale of the Binance hack serves as a sobering reminder of the vulnerabilities present within the cryptocurrency ecosystem. As exchanges fortify their defenses, the need for enhanced cybersecurity measures and international cooperation becomes increasingly critical to protect assets and restore trust within the digital currency landscape.