Binance blocks North Korea threats and has replaced 98% of tokens stolen in its $6.34 billion hack. Specifically, it blocked 57 suspected cyber threats in 2026.
Co-founder and co-CEO Yi He outlined the attempted intrusions. She posted on X on November 3. The post shared findings on the October 29 breach.
Why Binance blocks North Korea threats matters
Her account described repeated efforts to reach employees. Attackers used recruitment, software downloads, and social engineering. Techniques included fraudulent job interviews. Compromised software packages and browser extensions were also used. Malicious programs appeared as popular developer tools.
Fake video conferencing apps were another route. So were campaigns to steal credentials. Some aimed to install malware for remote computer access.
“We intercepted many of them,” Yi wrote. “But the cost of failing to stop even one was severe.” She added: “This should never have happened.”
How a fake interview reached an employee
Binance’s initial findings describe one case. A software engineer was approached in September. Someone posing as a project director used a legitimate job platform.
A supposed HR representative conducted a video interview. They shared a social media profile with personal photos. A second interviewer posed as a chief executive. That person instructed the engineer to download an assignment.
Binance said the assignment contained malicious code. It ran during setup and evaded endpoint security tools. On October 20, the attacker used the compromised computer. An internal AI tool helped reach two wallet engineers. Credentials from that intrusion enabled access to wallet signing.
Yi’s post did not break down how many of the 57 cases involved recruitment lures.
Earlier wallet findings traced part of the theft
Earlier findings traced part of the theft to Binance 14. That is an Ethereum hot wallet. Blockaid identified 50 submitted EIP-7702 authorizations. One successfully delegated execution rights to a malicious contract.
Binance reports 98% replenishment as purchases continue
In its November 3 report, Binance said 98% of impacted assets were replenished. It is buying the remaining, less liquid assets. The company set aside more than the funds required to cover the loss.
Previously, Binance reopened Bitcoin withdrawals on November 1. At that time, Richard Teng put replenishment at about 95%.
The exchange identified several fully backed assets. These included BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD, and ZEC. Other tokens took longer to purchase in required quantities.
Replacement purchases drew on SAFU, excess Futures Insurance Fund reserves, and corporate treasury. Withdrawals continue returning by asset and network. On November 3, Binance restored more withdrawals for 31 Ethereum assets. It also restored 20 Solana assets.
US investigators identify TraderTraitor activity
The FBI’s October 31 alert attributed the theft to North Korea. It identified the activity as TraderTraitor. The FBI worked with the Secret Service and IRS Criminal Investigation. They observed attackers converting stolen assets mainly into Ether. Further laundering through DeFi and instant swaps was expected.
Agencies urged exchanges and analytics firms to block related transactions. North Korea denied involvement on November 3. Kim Yo Jong rejected the FBI accusation in state media.
Stolen funds enter CoinJoin transactions
Separate tracing documented movement of stolen assets. Elliptic identified about 28 BTC worth $2.2 million. That Bitcoin entered 18 CoinJoin transactions between November 1 and early November 2. The Bitcoin came from converted stolen assets. Meanwhile, 18,270 BTC taken directly remained in 19 addresses.
Elliptic’s investigation covered about 12,000 wallets, 11 blockchains, and over 40,000 transactions. Theft-linked addresses still held an estimated $3.24 billion. Most was in Ethereum and Bitcoin.
Key takeaway
Binance blocks North Korea threats and replaced 98% of stolen tokens. The FBI attributes the hack to TraderTraitor. However, North Korea denies involvement. Therefore, traders should watch for official updates on remaining withdrawals.
