In September 2026, a Binance engineer interviewed for a new job. After a video call with a recruiter, the engineer met someone who claimed to be the company’s CEO. Near the end of that second interview came a coding assignment. When the engineer set it up on a work computer, the attackers got in.
That interview was one part of a breach that cost Binance about $6.3 billion on October 29. Binance said it would cover the losses. Its account of the breach helps explain how thieves could still move funds after the exchange began shutting down withdrawals.
How the attackers reached Binance’s wallets
Binance traced the first break-in back to June, when an employee downloaded a software tool the attackers had tampered with. The security team replaced the computer and changed the credentials, but the attackers had already learned who worked on the wallets. The fake interview in September gave them another way in. By October 20, they had reached computers used by developers who worked on the exchange’s wallets.
Nine days later, the attackers ran a script on one developer’s computer using credentials stolen from another. In the first four minutes, they moved 233.46 million XRP out of five Binance hot wallets, the online wallets an exchange uses to send funds. Transfers of bitcoin and other assets followed.
Binance moved to suspend withdrawals. By then, the attackers had already authorized a smart contract to move funds from an Ethereum wallet. That permission was recorded on the blockchain, outside the exchange’s withdrawal system. Nearly four hours passed before the final unauthorized transfer. In its November 3 update, Binance put the value of assets frozen or intercepted at about $2.85 billion. Separately, the company said it had set aside more than $6.34 billion of its own money to cover losses.
The FBI attributed the theft to TraderTraitor, a North Korean hacking group. North Korea denied involvement.
How Bybit staff were tricked into approving a $1.5 billion transfer
In February 2025, Bybit staff were moving funds between company wallets. Several people had to sign off on the transfer. They checked the wallet interface, saw what looked like the expected transaction and approved it. Bybit lost about $1.5 billion.
Investigators traced the breach to Safe, the company behind the wallet software Bybit used. With a Safe developer’s credentials, the attackers had been able to change what Bybit’s signers saw. Each person who reviewed the transfer relied on the same misleading screen.
Why the FBI linked the Binance and Bybit hacks to North Korea
The FBI attributed both thefts to TraderTraitor, a North Korean hacking group. North Korea denied involvement in the Binance attack. For exchanges, one detail stands out. At Bybit, the attackers found a way in through the company that supplied the wallet software. At Binance, they learned which engineers worked on the wallets and reached one of them while he was looking for a job. An exchange has to protect its wallets even when the first sign of trouble appears somewhere as ordinary as a job interview.
If the transfers are public, why is the money so hard to recover?
Anyone can follow a bitcoin transfer on the public ledger. An investigator can see how much moved, when it moved and which address received it. Knowing the address gives the investigator no way to sign a transaction sending the money back.
Where the funds end up matters. If stolen coins reach an exchange, that exchange may be able to freeze them before the thief withdraws them. Some stablecoin issuers can also freeze their tokens. If the thief still holds bitcoin in a wallet they control, there’s no bank to call and ask for a reversal.
That’s why the two figures Binance announced matter to customers in different ways. Frozen assets are funds someone has stopped from moving. The company’s reserves are money Binance can use to cover a shortfall while recovery efforts continue.
How does recovering crypto compare with recovering a bank payment?
If you spot an unfamiliar payment on your bank statement, you know whom to call. With crypto, the first question is where the funds went. A trading platform can check its own accounts, but its reach ends when the coins move to a wallet outside its control.
| Security factor | Traditional banking | Cryptocurrency |
|---|---|---|
| Transaction reversal | Sometimes possible through banking procedures | Confirmed on-chain transfers are generally irreversible |
| Central authority | Banks and payment networks control accounts | Depends on the blockchain, exchange, or custodian |
| Recovery options | Fraud investigations, legal remedies, and applicable protections | Exchange reimbursement, asset freezing, tracing, and legal recovery |
| Cross-border movement | Often involves intermediaries and compliance checks | Can occur directly across blockchain networks |
| Self-custody | Generally not applicable to ordinary bank deposits | Users can control private keys directly |
| Main security concern | Account fraud, system breaches, and institutional failure | Private-key theft, compromised signing, smart-contract exploits, and custody failures |
Who controls your crypto on an exchange or in a hardware wallet?
When you leave crypto on an exchange, the exchange controls the keys. You can request a withdrawal, but you depend on the company to process it. That arrangement can be convenient if you trade regularly. For coins you plan to leave untouched for years, it’s worth asking who you want to rely on to move them.
With a hardware wallet, you approve transfers on a device you control. The Trezor Safe 7 and OneKey Pro both let you review a transaction on the device itself. Both makers publish their firmware. If your laptop shows one address and the wallet shows another, you can spot the mismatch before you sign.
You also take responsibility for the backup. Someone who gets your recovery phrase can restore the wallet without having your device. Keep the phrase offline, and check that you understand the recovery process before moving a large balance.
Frequently asked questions
Q1: Did the Binance attackers break Bitcoin’s security?
Binance’s investigation traced the transfers to compromised employee computers and stolen credentials. Bitcoin kept processing transactions, including the ones the thieves had gained the authority to make.
Q2: Would a second hardware wallet help if my first one were stolen?
A second device set up with the same recovery phrase can help you regain access if you lose the first one. It won’t protect the funds if someone finds the phrase. A two-of-three multisignature wallet works differently. It uses three separate keys and requires any two to move funds, so one stolen key alone isn’t enough.
Q3: What can I do if a wallet asks me to approve something I don’t recognize?
Cancel the request. If you expected a transfer, compare the amount and full destination address on the device with the details you got from the recipient. If the device shows a contract action you can’t interpret, leave it unsigned until you understand what it allows.
Sources
- Binance — Initial findings and response, November 3
- Reuters — How the attackers gained access to Binance
- Reuters — Binance sets aside funds to cover losses
- Associated Press — North Korea’s response to the FBI’s attribution
- Bybit — Findings from the Safe wallet investigation
- Trezor — Safe 7 specifications
- OneKey — Security and open-source software
