FBI blames North Korea for $6.34bn Binance theft

The FBI said on October 31 that North Korea was responsible for stealing more than $6 billion in virtual assets from Binance on October 29; Binance’s later account put the impact at about $6.34 billion. The attribution and technical account show how an attack on exchange infrastructure enabled a record-scale theft across multiple crypto networks.

The FBI identified the activity as TraderTraitor, a North Korean hacking operation, and said investigators had observed the stolen assets being converted primarily into ether. The bureau, alongside the U.S. Secret Service and IRS Criminal Investigation, urged crypto services to block transactions linked to the listed addresses. Its public attribution and warning give firms a basis to screen for the funds as they move.

How did the attackers get funds out of Binance wallets?

Binance says the attackers gained unauthorized access to an internal wallet-signing service and used it to initiate transactions outside the normal withdrawal process. The exchange’s November 3 incident report describes transfers from hot wallets on several networks, including 233.46 million XRP, about 970,500 SOL, 44.2 million OP and 18,270 BTC. Binance also reported that the attacker exploited Ethereum’s EIP-7702 authorization mechanism.

EIP-7702 lets an account delegate certain execution rights to a smart contract without disclosing its private key. Binance says the attacker used it to grant an attacker-controlled contract partial execution rights over a hot wallet. That distinction matters: Binance reported no evidence that wallet private keys had leaked, but existing on-chain authorizations still allowed assets to move independently of the exchange’s ordinary withdrawal system.

Binance says the attacker submitted 50 signing transactions to manipulate the wallet’s account nonce and establish the malicious delegations. Suspending withdrawals could not, by itself, revoke those permissions. The wallet used multi-party computation (MPC), with no single private key available to immediately cancel the authorizations, so the exchange had to develop a separate procedure. Binance says the final unauthorized transfer finalized at 23:56 UTC on October 29; it cleared the delegation code at 00:10 UTC on October 30.

What did Binance say about the route into its systems?

The exchange describes a campaign that began months before the theft and involved social engineering, malware and compromised internal tools. In September, an attacker posing as a recruiter contacted an engineer through a job-hunting platform, conducted staged interviews and sent a malicious coding assignment. Binance says the repository ran malware when installed on the employee’s work computer, allowing the attacker to establish contact with an external server and later reach other employees and systems.

Binance also traced an earlier compromise to a tampered software installer downloaded by another engineer in June. The exchange says that initial anomaly prompted it to replace a device and rotate credentials, but the employee’s role and colleagues on the wallet infrastructure team had already been exposed. It says the attacker later used stolen credentials and a deployment token to reach wallet-signing operations.

How much was frozen, and what happens next?

Binance reported that about $2.85 billion had been frozen or intercepted, subject to reconciliation and market-price changes. As of October 31, it said 98% of the impacted token assets had been replenished and were verifiable through its proof-of-reserves page. Those figures describe different things: replenishment concerns Binance’s coverage of affected assets, while freezing concerns funds traced or stopped on-chain.

The FBI said the assets were being converted mainly into ether and were expected to move through decentralized finance and instant-swap services for further laundering. It asked service operators to block transactions involving the listed addresses or assets derived from them. Binance says it has rebuilt affected systems and is commissioning an independent security review; its investigation remains open.

Sources and documents

• public attribution and warning — fbi.gov
• November 3 incident report — binance.com