Binance says a months-long intrusion reached an internal wallet-signing service and enabled attackers to move about $6.34 billion in digital assets, prompting the exchange to suspend withdrawals.
The exchange’s preliminary estimate may change after reconciliation and with market prices. Binance said the transfers bypassed its usual withdrawal process. Five hot wallets transferred 233.46 million XRP between 4:05 and 4:09 p.m. EDT Thursday, Oct. 29 (20:05–20:09 UTC), according to its initial report. Other transfers included about 970,500 Solana (SOL), 44.2 million Optimism (OP) and 18,270 Bitcoin (BTC).
As of the update, about $2.85 billion in assets had been frozen or blocked; Binance said the amount remained subject to verification and market-price changes. The exchange said 98% of affected token assets had been replenished by Saturday, Oct. 31. Binance said it would absorb the financial loss, telling users, “Binance will absorb the financial impact of the stolen funds, not our users.”
Binance said attackers used a compromised computer and internal AI tools to reach devices belonging to two wallet engineers on Oct. 20. They found a token with container-deployment permissions on one device, the exchange said.
The compromised computer was linked to a recruitment approach in September, Binance said. An engineer was contacted on a legitimate job platform by someone posing as a project director and, after two interviews, was asked to download a coding assignment to a work computer. Malicious code activated as the assignment was set up, while endpoint defenses failed to detect it, Binance said.
Binance traced another part of the intrusion to June, when an engineer searching online for an AI coding product obtained an altered Homebrew installer. The exchange said it later identified unusual activity, replaced the device and changed related credentials, but information about the engineer and colleagues had already been exposed.
The Federal Bureau of Investigation (FBI) said North Korea was responsible for the theft and identified the activity as ‘TraderTraitor.’ The bureau said it observed the actors converting stolen assets mainly into Ether (ETH).
Binance said it rebuilt the affected wallet system and internal AI tools, replaced devices, disabled related credentials and completed enhanced security scans. It plans to invite independent cybersecurity experts to review the incident and its findings, but has not announced a timetable.
