\n
![](\"https:\/\/media.crypto.news\/2025\/02\/crypto-news-North-Korean-hacker-option01.webp\")
<\/p>\n
\n<\/p>\n
Binance says it blocked 57 suspected North Korea-linked cyber threats in 2026 and has replaced 98% of the tokens stolen in its $6.34 billion hack.<\/p>\n
\n Summary<\/span>\n <\/p>\n <\/p>\n Binance co-founder and co-CEO Yi He outlined the attempted intrusions in a Nov. 3 post on X<\/a>, sharing the exchange\u2019s findings on the Oct. 29 security breach.<\/p>\n Her account described repeated efforts to reach employees through recruitment, software downloads, and social engineering. The techniques included fraudulent job interviews, compromised software packages and browser extensions, and malicious programs presented as popular developer tools.<\/p>\n Fake video conferencing applications were another route, alongside campaigns designed to steal credentials or install malware that gives attackers remote access to a computer.<\/p>\n \u201cWe intercepted many of them, but the cost of failing to stop even one was severe\u2014and this should never have happened,\u201d Yi wrote.<\/p>\n<\/blockquote>\n <\/p>\n According to Binance\u2019s initial findings<\/a>, a software engineer was approached in September through a legitimate job-hunting platform by someone posing as a project director.<\/p>\n A supposed human resources representative conducted a video interview and shared a social media profile containing personal photos and videos. A second interviewer, presented as the chief executive of a fictitious company, instructed the engineer to download an assignment onto a work computer.<\/p>\n Binance said the assignment contained malicious code that ran during setup and escaped detection by the endpoint security tools in use.<\/p>\n On Oct. 20, the attacker used the compromised computer and an internal AI tool to reach two wallet engineers. Credentials obtained during that intrusion subsequently enabled access to wallet signing operations.<\/p>\n The exchange\u2019s account describes several stages of intrusion, although Yi\u2019s post does not break down how many of the 57 suspected cases involved recruitment lures.<\/p>\n Earlier wallet authorization findings<\/a> traced part of the theft to Binance 14, an Ethereum hot wallet. Blockaid identified 50 submitted EIP-7702 authorizations, one of which successfully delegated execution rights to a malicious contract.<\/p>\n In its Nov. 3 report, Binance said 98% of the impacted token assets had been replenished and that it was buying the remaining, less liquid assets. The company said it had set aside more than the funds required to cover the loss.<\/p>\n As crypto.news previously reported, Binance reopened Bitcoin withdrawals<\/a> on Nov. 1, when Richard Teng put replenishment at approximately 95%.<\/p>\n The exchange had identified BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC as fully backed. Its recovery notice said the outstanding tokens outside that group took longer to purchase in the quantities required.<\/p>\n Replacement purchases have drawn on the Secure Asset Fund for Users, excess reserves from the Futures Insurance Fund and Binance\u2019s corporate treasury, according to its earlier recovery disclosures.<\/p>\n Withdrawal access has continued returning through individual assets and networks. On Nov. 3, Binance restored more withdrawals<\/a> for 31 additional assets on Ethereum and 20 on Solana, following the reopening of five Ethereum stablecoins.<\/p>\n The FBI\u2019s Oct. 31 cyber alert<\/a> attributed the theft to North Korea and identified the activity as TraderTraitor.<\/p>\n Working with the US Secret Service and IRS Criminal Investigation, the bureau observed attackers converting stolen assets primarily into Ether. It said further laundering through decentralized finance and instant swap services was expected.<\/p>\n The agencies urged exchanges, blockchain analytics firms, DeFi services and infrastructure operators to block transactions involving the listed addresses or assets derived from them.<\/p>\n North Korea denied involvement on Nov. 3. According to the Associated Press, Kim Yo Jong rejected the FBI\u2019s accusation in a statement carried by state media.<\/p>\n Separate tracing work has documented the movement of stolen assets while Binance purchases replacements.<\/p>\n Elliptic identified approximately 28 BTC, worth $2.2 million, entering 18 CoinJoin transactions<\/a> between Nov. 1 and early Nov. 2. The Bitcoin came from converted stolen assets, while the 18,270 BTC taken directly from Binance remained in 19 addresses at that assessment.<\/p>\n The firm\u2019s investigation covered roughly 12,000 wallets, 11 blockchains, and more than 40,000 transactions. Theft-linked addresses still held an estimated $3.24 billion, mainly in Ethereum and Bitcoin.<\/p>\n <\/p><\/div>\n\n\n
\n
Binance describes how a fake interview reached an employee<\/h2>\n
Binance reports 98% replenishment as token purchases continue<\/h2>\n
US investigators identify TraderTraitor activity<\/h2>\n
Stolen funds enter CoinJoin transactions<\/h2>\n