Binance published an incident report on Tuesday, November 3, 2026 describing how attackers stole about $6.3 billion in cryptocurrency on October 29, according to The Register and TechCrunch. The report cites deceptive job interviews, malware downloads, a compromised internal AI tool, device takeover and an “advanced transaction-authorization method.” Binance said its investigation indicates “this was a sophisticated, multi-stage campaign” and “was not a single isolated breach or a simple phishing incident,” The Register reports. Lens reported the FBI’s attribution of the theft to North Korea on November 1; this post covers what Binance’s report adds.

The timeline in Binance’s report

The Register’s account of the report gives the sequence below. Binance describes its findings as coming from a “current investigation,” so they are preliminary.

  • June: an engineer, called Engineer A in the report, downloaded a malicious Homebrew installation in what Binance describes as a supply chain attack. Security staff detected the malware, the device was replaced and affected credentials were rotated.
  • September: someone posing as a project director contacted another software engineer through a “legitimate job-hunting platform” and arranged interviews with a fake company. The first round was a live video interview with a fake HR representative, who shared a social media account with personal content to build trust; Binance called this “more advanced and deceptive than previously seen social engineering approaches.” In the second round, someone posing as the fake company’s CEO, using a popular chat app, told the engineer to download an “assignment” containing a malware-laced code repository, which ran on his work computer during setup.
  • Malware behavior: the malware replaced a legitimate development-tool component with a malicious version, ran commands and connected to an attacker-controlled server, hiding its script. Binance said its endpoint security tools did not catch it right away.
  • October 20: attackers used the compromised computer and an internal AI tool to reach the computers of Engineer A, a wallet DevOps engineer, and Engineer C, a wallet software developer. Engineer A’s computer held a container deployment permission token, which the attackers found.
  • October 29: the attacker accessed Engineer C’s computer, used Engineer A’s stolen credentials to deploy a container and triggered a script that launched the theft.

Attribution

The Register says the FBI attributed the theft, over the weekend before its publication, to TraderTraitor, a North Korean hacking operation linked to the Lazarus Group, and that its article does not report Binance itself naming a group. TechCrunch says Binance’s statement also names North Korean hackers and that the FBI and blockchain investigators have blamed North Korea. TechCrunch adds that North Korea is widely accused of crypto thefts to fund its nuclear weapons program, which is under international sanctions. By Binance’s own account, per TechCrunch, it faced at least 57 suspected North Korean attacks, which it called a “persistent threat posed by state-sponsored actors targeting the cryptocurrency industry.”

Binance’s response

  • It rebuilt the compromised wallet system and the internal AI tool, replaced affected devices, and decommissioned credentials and tokens assigned to the compromised engineers, per The Register.
  • It is working with law enforcement, blockchain intelligence firms and security researchers to trace and freeze assets, and has hired independent cybersecurity experts to review the incident.
  • It is working to set up a security research fund and initiatives with AI companies and security firms on AI security in blockchain environments.
  • Binance said the attack “should not have happened,” according to TechCrunch.

What was not answered

TechCrunch reports that a Binance spokesperson referred it to the public statement and declined to say on the record whether Binance blocks unauthorized code on employee laptops or whether third parties audited its network before the theft. TechCrunch also notes that researchers have warned for years about North Korean operatives posing as recruiters and investors, citing its own June 10, 2026 report that about half of intrusions at US tech companies last year were attributed to North Koreans posing as remote IT workers and impostor recruiters.

Sources and notes

This post is based on The Register’s report by Jessica Lyons, published at 22:04 UTC on November 3, 2026, and TechCrunch’s report by Zack Whittaker, published at 11:45 a.m. PST the same day. Lens did not read Binance’s incident report, its statement on X or the FBI alert directly. The timeline is Binance’s own account as relayed by those outlets and is not independently verified; “record” is the outlets’ description. The two outlets differ slightly: The Register dates the first contact to September, while TechCrunch says the approach unfolded over several months. Lens did not contact Binance.

Image: source code on a laptop screen, by Marc Mueller (seven11nash) via Wikimedia Commons, licensed under CC0; cropped. Illustrative photo; it is not related to Binance and does not show the events described.