Our coverage of the Binance theft — about $6.3 billion drained in about 20 minutes in October 2026, the largest crypto theft on record — and the recovery effort that followed.
Latest: Binance update: a fake job interview planted the malware behind the $6.3 billion theft, and $2.85 billion is now frozen or intercepted (disclosed 2026-11-03)
Binance said in a November 3 incident report that the October 29 theft began in September with a fake job interview that tricked a software engineer into running malicious code, spread to two more wallet-infrastructure employees, and reached its wallet signing service; about $2.85 billion is now frozen or intercepted — follow-up to our October 29 report.
Binance said it has covered about 95% of the roughly $6.3 billion stolen on October 29 and is resuming withdrawals in phases from November 1 across 15 networks, and the FBI attributed the theft to North Korea’s TraderTraitor unit.
Binance confirmed attackers breached its systems, including a DevOps engineer’s laptop, and drained about $6.3 billion from its wallets in about 20 minutes on October 29; deposits and withdrawals were suspended, about $2.7 billion has been frozen, and the exchange says user funds are safe and all losses will be covered.