Binance attributes $6.34 billion cyberattack to North Korea, boosts AI security

Binance attributed the 29 October cyberattack to North Korea, citing information from the Federal Bureau of Investigation (FBI), and said the attackers used fraudulent recruitment interviews to infiltrate its systems.

Binance disclosed this on Tuesday, noting that approximately $6.34 billion in digital assets were affected by a security breach on 29 October.

The cryptocurrency exchange said it would absorb the financial impact of the incident rather than pass the loss on to users, adding that it had set aside more than 100 per cent of the funds required to cover the stolen assets.

Binance said it has frozen or intercepted about $2.85 billion in assets and replenished 98 per cent of the affected tokens.

“As of 31 October 2026, 98% of the impacted token assets have been replenished and are verifiable on our Proof of Reserves page. We are in the process of purchasing the outstanding, more illiquid assets,” the cryptocurrency exchange stated.

Investigation

Binance said its investigation showed that attackers gained unauthorised access to an internal wallet-signing service and used it to initiate transactions outside the exchange’s normal withdrawal process.

It said the breach resulted from a multi-stage campaign involving social engineering, malicious software, compromised internal artificial intelligence tools, and unauthorised access to employees’ devices.

“Our current investigation indicates that this was a sophisticated, multi-stage campaign. It was not a single isolated breach or a simple phishing incident,” Binance said.

It traced part of the attack preparation to June 2026, when an engineer on its wallet development and operations team downloaded a tampered software installation while trying to install an AI coding tool.

Although the company’s security team detected the anomaly, replaced the affected device and changed related credentials, Binance said the attack had exposed the engineer’s role and colleagues working on its wallet infrastructure.

In September, another software engineer was allegedly targeted through a fraudulent recruitment process involving individuals posing as representatives of a fictitious company.

Binance said the engineer was invited to two online interviews and was then instructed to download an assignment containing malicious code onto a work computer.

The malicious software allegedly compromised the engineer’s device and enabled the attackers to communicate with an external server under their control.

On 20 October, the attackers allegedly exploited the compromised computer and an internal AI tool to access other employees, including an engineer with a container deployment permission token.

Binance said the attackers eventually used credentials obtained from the compromised employees to access wallet-signing operations and execute the 29 October attack.

The company disclosed that its security team had detected and prevented 57 suspected North Korea-linked cyber threat cases throughout 2026.

“Throughout 2026, Binance’s security team detected and prevented 57 suspected North Korea-linked cyber threat cases,” the cryptocurrency platform said, explaining that the attempts reflect the persistent threat posed by state-sponsored actors targeting the cryptocurrency industry.

It also said the latest information released by the Federal Bureau of Investigation (FBI) indicated that North Korea was responsible for the attack.

“The latest information released by the Federal Bureau of Investigation indicates that the Democratic People’s Republic of Korea is responsible for this incident,” Binance said.

Security overhaul

Following the incident, the exchange said it had rebuilt the affected wallet system in a new environment, rebuilt its internal AI tool and access controls, replaced affected devices and decommissioned credentials and tokens associated with the compromised employees.

It also said it had completed enhanced security scans across employee devices, strengthened wallet-service risk controls and expanded its use of artificial intelligence to detect unusual behaviour.

The company said it was working with law enforcement agencies, blockchain intelligence firms and industry partners to trace and freeze affected assets.

Binance also announced plans to engage independent cybersecurity experts to review the incident, validate its findings and recommend additional security measures.

READ ALSO: Binance reserves $6.34bn to cover stolen assets after cyberattack – CEO

It said it would increase investment in AI-enabled threat detection, endpoint protection, developer-environment security and behavioural anomaly monitoring.

The exchange is also working to establish a security research fund and targeted initiatives with AI companies, industry participants and cybersecurity firms to strengthen security in blockchain environments.

“This is our initial report. It covers what we know today and what we have already improved. The investigation remains ongoing, and our findings will be subject to further independent review,” Binance said.