Binance says fake LinkedIn recruiter, not stolen keys, enabled record $6.3 billion crypto theft

Binance, the world's largest cryptocurrency exchange, said Tuesday that a months-long social-engineering campaign against a single software engineer, not a stolen encryption key, opened the door to the largest cryptocurrency theft on record: a $6.3 billion drain of its wallets last week that investigators have linked to North Korea.

The disclosure, reported by Fortune after it reviewed Binance's internal incident account, fills in a gap that had puzzled security researchers since the theft on October 29: how attackers managed to move roughly $6.3 billion off the exchange in minutes without ever obtaining its private signing keys.

How the breach unfolded

According to the account Binance gave Fortune, a hacker posing as a "Project Director" contacted a Binance software engineer, referred to as Engineer B, through a job-hunting platform after noticing the engineer's profile mentioned the company. The fake recruiter strung the engineer through a first-round interview with a purported HR contact and a second round with someone posing as the chief executive of a fictitious firm, a courtship that stretched over months. Separately, another Binance engineer downloaded what appeared to be the developer tool Homebrew from an internet advertisement rather than through the company's normal channels; Binance's defenses caught and removed the resulting malware, but not before the intruders learned who managed the exchange's crypto wallets.

Binance told Fortune the breach itself relied mainly on conventional phishing rather than artificial intelligence. But once the attackers controlled Engineer B's laptop, they used an internal Binance AI tool to take over the accounts of two more employees, a wallet DevOps engineer and a wallet software engineer, and from one of those machines retrieved a container-deployment permission token. That token, blockchain-analytics firm Elliptic said in a technical write-up, let the intruders manipulate Binance's own transaction-signing infrastructure rather than steal any private key outright: on Ethereum they abused a wallet-delegation feature to seize a hot wallet and drain it through a "sweeper" contract, while on other chains funds left through what looked like ordinary, properly signed transactions.

Record-breaking numbers

Binance has put the total impact at about $6.3 billion; Elliptic's own tally, which it says is "almost certainly the largest single theft of any kind," puts the figure slightly higher at $6.43 billion. Most of the money left ten different blockchains in roughly 20 minutes on October 29, according to blockchain-intelligence firm TRM Labs. Stablecoin issuers Tether and Circle froze a combined sum Fortune put at roughly $2.5 billion in affected tokens; Elliptic separately verified about $2.85 billion, or 44 percent of the theft, as frozen or seized, while estimating that some $3.25 billion sits unrecoverable across more than 800 wallet addresses holding assets such as bitcoin and XRP that cannot be frozen by any issuer.

Binance paused withdrawals for roughly 48 hours and has been restoring them in stages since, according to its own recovery updates. On November 2 the exchange said users could independently verify its October 31 reserves snapshot using a cryptographic zero-knowledge proof, and on Tuesday it reopened withdrawals for dozens of additional assets across nine blockchain networks. Fortune reported that Binance has replaced 98 percent of the stolen coins from its own reserves and other sources and is working to acquire the remaining 2 percent, a mix of less-liquid tokens.

A familiar playbook, at unprecedented scale

The theft dwarfs the previous record, the $1.5 billion taken from exchange Bybit in February 2025, which U.S. and South Korean authorities also attributed to North Korean operatives. Blockchain-analytics firms TRM Labs and Chainalysis both said they had high confidence the Binance theft was the work of TraderTraitor, a hacking unit tied to North Korea's intelligence services that has spent years posing as recruiters, job applicants and open-source contributors to infiltrate cryptocurrency firms. The trade publication Nextgov/FCW reported that the FBI aligned with that assessment over the weekend following an earlier statement that it was "engaged with relevant public and private partners," and that a U.S. intelligence assessment estimates North Korea has netted at least $1 billion annually from crypto heists and related financial crimes, proceeds investigators say help fund the country's weapons programs.

Binance said it had already been fending off similar attempts: the company told reporters it detected or blocked 57 North Korea-linked hacking attempts in 2026 before the breach, mostly fake job applications and recruiter outreach aimed at employees in sensitive roles. The company maintains a policy barring staff in non-public-facing positions from keeping LinkedIn profiles, and a spokesperson would not say whether Engineer B had violated that rule or whether either engineer involved would face termination.

Who is affected, and the reaction

Binance says customer deposits were never at risk and that the company, not its users, will absorb the loss. In an internal incident report quoted by Fortune, the company struck an apologetic tone: "This should not have happened, and we apologise for the concern, disruption and uncertainty," it said, addressing users, partners and the broader industry. Beyond Binance's own customers, the episode rattled stablecoin issuers and rival exchanges that had to coordinate emergency freezes within hours, and on-chain investigators noted that some laundered funds became commingled with proceeds from a separate, smaller North Korea-linked theft from exchange Bitget in September.

The episode has also sharpened a broader warning from cybersecurity officials about artificial intelligence and state-linked hacking. Although Binance says the breach itself did not depend on generative AI beyond the internal tool the attackers hijacked, Britain's National Cyber Security Centre warned this week that artificial intelligence is reshaping cyber operations broadly, and that it expects adversaries including North Korea, China and Russia to rely on AI-enabled hacking tools as a matter of routine within two years.

• Total impact: about $6.3 billion to $6.43 billion, depending on the estimate
• Frozen or recovered: roughly $2.5 billion to $2.85 billion, according to Binance and Elliptic
• Time to drain wallets: about 20 minutes across ten blockchains
• North Korea-linked attempts blocked by Binance in 2026 before the breach: 57

What happens next

Binance has not yet published the comprehensive root-cause report it promised investors and users, and the company has said its investigation uncovered "additional points of breach" beyond the initial laptop compromise, without elaborating. Restoring full withdrawal service for its least-liquid assets is likely to continue through the rest of the week. Law enforcement attention is expected to shift toward tracing and freezing the roughly $3.25 billion in funds that remain beyond issuers' reach, a process Elliptic's chief scientist has said could take North Korea-linked launderers months to complete through intermediaries, cross-chain bridges and decentralized exchanges. For an industry still absorbing the scale of the loss, the more immediate reckoning is likely to center on employee vetting: security researchers have renewed calls for crypto firms to treat unsolicited recruiter contact, even on ordinary professional networking sites, as a standing threat rather than a routine nuisance.