On the evening of October 29, approximately $6.3 billion in digital assets was stolen from Binance in a massive heist triggered by a fake interview email and spanning 10 blockchains.
From hackers lying low for four months and draining a hot wallet in 20 minutes, to multiple parties launching cross-chain tracing and freezing funds, the five-day battle between attackers and defenders was more gripping than a movie.
A Deadly 20 Minutes: A Precisely Planned Breach Four Months in the Making
At 4:05 a.m. Beijing time on October 30, Binance suffered the largest security breach in its history, with approximately $6.3 billion in digital assets stolen in just 20 minutes.
Market analysis indicates that this flawless heist, spanning 10 blockchains, was in fact the culmination of a carefully planned, four-month social engineering attack. What appeared to be a disaster that struck in an instant was actually the explosive result of months of plotting.
The attackers completed their on-chain deployment 36 hours in advance, armed with 50 pre-signed authorization credentials. Just 3 minutes and 24 seconds after one of them took effect, Binance’s Ethereum hot wallet was drained, and more than 167,000 ETH vanished in an instant.
Freezing and tracing: a “cat-and-mouse game” on two fronts
Thirty-seven minutes after the crisis erupted, Tether was first to hit the freeze button, locking up $971 million in USDT. Three minutes later, Circle followed suit, freezing $823 million in USDC.
So far, about $2.85 billion has been frozen, accounting for 44% of the total stolen. This figure far exceeds the 3% freeze rate when $1.5 billion was stolen from Bybit last year, highlighting the key role stablecoin issuers play in responding to crises.
On October 31, the U.S. FBI issued a notice attributing the attack to the North Korean hacking group TraderTraitor, also identified as the force behind last year’s Bybit incident.
Blockchain analytics firm Elliptic found that the hackers split the stolen funds among approximately 12,000 wallets across 11 chains, carrying out more than 40,000 transactions.
Around $3.2 billion, mainly in Bitcoin and Ethereum, remains under the hackers’ control. Several large Ethereum addresses have remained untouched since the day of the attack, seemingly awaiting the best opportunity to cash out.
The attack route: a social engineering attack triggered by a fake job interview
Binance’s preliminary investigation report, released on November 3, revealed a shocking chain of events. According to information disclosed by market sources, as early as June this year, a wallet management engineer clicked on a malicious online ad. Although it was detected and the device was replaced, the hackers had already identified their target.
In September, another engineer received an interview invitation for a “project director” role on a job platform. After a video interview with HR and a remote meeting with the CEO, among other steps, the hackers used a coding assignment as a pretext to install a zero-day Trojan on the engineer’s work computer. It replaced a legitimate Python tool with an infected version and quietly connected to the hackers’ server.
On October 20, the hackers used this as a foothold to move laterally through Binance’s internal systems with the help of an AI tool, successfully taking control of two engineers’ computers, one of which had deployment privileges. Nine days later, $6.3 billion in assets had “vanished.”
Binance said it had successfully blocked 57 similar suspected North Korean attacks this year, but this one slipped through. The incident shows that even the most robust defenses can struggle to fully withstand a carefully planned social engineering attack.
Withdrawals put user confidence to the test as the hacking fallout continues
On November 1, Binance resumed withdrawals, putting user confidence to the test. In the 9.5 hours after withdrawals reopened, users withdrew a total of $4.65 billion and deposited $1 billion. Still, 98% of users chose to remain on the platform, with net outflows at just 2.1%.
CZ emphasized on social media: “This year’s revenue is enough to cover the losses. We won’t sell our SpaceX shares.” Musk had previously poked fun at Binance’s promise to cover the losses in full, to which CZ replied: “I respect you a lot, but this is not the time to joke.”
As the incident continued to escalate, Kim Yo Jong, Kim Jong Un’s sister, spoke out on November 3, rejecting claims linking the theft to North Korea. She called the U.S. accusations “the same old provocation” and “absurd and utterly unoriginal.” This was North Korea’s first official response to the incident.
A deeper look: three key warnings from the incident
The incident exposed the vulnerabilities of decentralized finance. First, the crypto world, which claims to be decentralized, still relies on centralized entities such as Tether and Circle to step in at critical moments. Second, proof of reserves is not an audit: it can show that assets exist, but cannot guarantee their security.
Third, the most dangerous vulnerabilities are often not in on-chain code, but in human weaknesses and a lack of awareness. A tempting high-paying job ad, a seemingly genuine interview, and a coding assignment were all it took to open the door to $6.3 billion.
As industry experts have said, exchanges are best suited to serve as cashiers for moving funds, not as vaults for storing assets long term. This incident is also a wake-up call for every holder: there is no time to waste in reassessing whether your asset custody arrangements are secure!