North Korean Unit's Hack of Binance

Nov 7 · Hackers move $2.5 billion of stolen Binance funds in single transaction Updated 18:04

Hackers moved $2.5 billion of the stolen funds in a single transaction, which Bloomberg reports represents 40% of the total stolen cryptocurrency. Bloomberg reports the hackers spent $15 to weaponize an Ethereum blockchain feature that allows accounts to grant software permission to move funds without separate authorizations for every transfer. CNBC reported that the security breach at Binance impacted $6.34 billion in assets.

Bloomberg reveals a stark asymmetry in the heist's execution: a $15 expenditure to weaponize a convenience feature on the Ethereum blockchain enabled the movement of $2.5 billion in a single hit. This provides a concrete answer to the first analysis's question regarding the speed of the theft, showing that the rapid multi-chain drain was not just a result of stolen keys, but the strategic use of permission-granting features to bypass repeated authorizations.

This finding shifts the technical narrative from the infiltration of the exchange's internal systems to the exploitation of the blockchain's own architecture. While previous reports focused on how the hackers got inside Binance, this reporting highlights how they leveraged the underlying protocol to minimize the risk of detection during the exit phase.

CNBC moves the focus away from the specific technical breach to a broader social trend, framing the incident as a case study in the rise of AI-powered job scams [1]. By linking the Binance hack to a general increase in employment-related losses, the coverage treats the event as a symptom of a struggling job market and the weaponization of AI in fraudulent communications.

Nov 6 · Binance breach began with malicious ad and tampered Homebrew installation Updated 17:15

The breach began when a wallet developer clicked a malicious ad while attempting 'vibe coding' with an AI tool, which led to the installation of a tampered version of Homebrew. By October, attackers used an internal AI tool to seize control of multiple developer computers. The stolen assets included 233.46 million XRP.

Futurism connects the technical breach to a specific cultural shift in software development, identifying 'vibe coding'—the practice of using AI to generate code based on general intent rather than precise specifications—as the catalyst for the initial infection. This detail explains how a developer was lured into installing a tampered version of Homebrew, transforming the incident from a random phishing attack into a failure of AI-integrated workflows.

The revelation that attackers later weaponized an internal AI tool to seize multiple computers answers the first analysis's question about how a single laptop compromise could scale so rapidly. The breach was not a linear path from one device to the vault, but a multi-stage escalation where AI tools were used both as the entry vector and the internal expansion mechanism.

While previous reports focused on the identity of the hackers or the recovery of funds, this coverage shifts the focus toward the systemic risk of corporate AI adoption. It suggests that the speed and scale of the heist were enabled by the very tools intended to increase developer productivity.

Nov 5 · Attackers compromised Binance engineer's laptop via tampered Homebrew Updated 21:00

Ars Technica reported that attackers compromised an engineer's laptop after he downloaded a tampered version of Homebrew. According to The Verge, the attack began in June with a malicious Google ad and the hackers used a 0-day malware that bypassed endpoint security. Binance stated that the use of Multi-Party Computation (MPC) prevented the immediate revocation of malicious authorizations, and Breitbart reported that the hackers used a deployment permission token to drain funds. Richard Teng apologized for the failure, according to Breitbart.

Ars Technica and The Verge provide the final pieces of the technical puzzle. By identifying a tampered version of Homebrew and a 0-day malware, they show the attackers did not just exploit a human error but poisoned a trusted developer tool to bypass endpoint security. This explains how a single laptop compromise could scale into a multi-chain heist in minutes.

The focus has shifted from the entry point to the failure of internal controls. The Verge highlights a critical gap in the exchange's defense: the use of Multi-Party Computation (MPC) actually prevented the immediate revocation of the malicious authorizations once the breach was detected.

While Breitbart focuses on the social engineering success and the CEO's apology, The Verge presses a deeper question that remains unanswered. It notes that the exchange failed to explain why it ignored known warnings about fake job interview malware or how its own internal AI tools were weaponized by the attackers [1].

Nov 4 · Binance reports covering 95% of impacted funds following $7.4 billion in customer withdrawals Updated 20:01

Yahoo Finance reported that the attack occurred around October 29, 2026. Binance co-founder Changpeng Zhao stated that systems have returned to normal, withdrawals are restored, and all user funds are covered, though he added that 100% security is impossible and he did not expect a hack of this magnitude. To replenish balances, Binance used insurance, corporate treasury reserves, and the Secure Asset Fund for Users (SAFU). Binance reports it has covered approximately 95% of the impacted funds, with the remaining 5% consisting of less liquid tokens; CBS News also reported that Binance has covered about 95% of the impacted amount, while CNBC reported that Binance has replenished 98% of the affected assets using its own reserves. Following the theft, Binance customers withdrew $7.4 billion. A Binance spokesperson stated that $2.7 billion was deposited after transactions resumed, resulting in a net outflow of $4.7 billion, or 3% of the company's total assets. Elliptic reports that $3.24 billion remains in addresses linked to the theft, and the NY Post reported that approximately $3.3 billion of the stolen funds remain unfrozen. The NY Post also reported that the laundering operation involved moving assets across 10 blockchains and using 12,000 digital wallets within days, and that investigators suggest funds could only be recovered or blocked if the Chinese government cracked down on the illicit banking networks facilitating these transactions. CNBC reported that attackers used a fake developer tool in June and fake job interviews with malware-laden coding exercises in September to infiltrate the system, which allowed hackers to compromise internal AI tools and gain access to the wallet transaction authorization system. NPR reported the attack began with a failed penetration attempt in June, which allowed hackers to study Binance's systems. The Washington Post reported that a Binance software engineer was targeted via a fake job opportunity involving an initial video interview and a second interview via a social chat app with a person claiming to be the prospective company's CEO, and that the engineer was asked to download code onto his work computer as part of a technical test. Binance has rebuilt the affected systems, replaced compromised devices, and hired an independent expert for a security review. Regarding the perpetrators, the FBI linked the TraderTraitor group to a $1.5 billion attack on Bybit in February 2025. Experts and blockchain investigators told the NY Post that the stolen funds are believed to finance North Korea's missile and nuclear weapons programs. North Korea denied allegations of involvement, and Kim Yo Jong, representing North Korea, called the FBI's claims a provocation and 'absurd rhetoric,' according to The Guardian and CBS News. Binance co-CEO Richard Teng did not personally attribute the attack to North Korean hackers, despite the FBI's link.

CNBC and Washington Post provide the missing link to the technical mystery by detailing a multi-month infiltration. The use of fake developer tools and malware-laden coding exercises during job interviews explains how attackers bypassed security to compromise internal AI tools and the authorization system. This transforms the narrative from a simple laptop compromise to a sophisticated social engineering and supply-chain attack.

The net outflow of $4.7 billion reported by CBS News reveals a deep crisis of confidence. While Binance has covered 95% to 98% of the losses using its own reserves, the massive withdrawal of funds suggests that financial reimbursement does not fully offset the perceived risk of systemic insecurity.

NY Post highlights a critical bottleneck in fund recovery by noting that the stolen assets are now tied to Chinese illicit banking networks. This shifts the recovery narrative from a technical blockchain challenge to a geopolitical dependency, where recovery depends on the Chinese government's willingness to crack down on these networks.

Elliptic's report that $3.24 billion remains in linked addresses confirms that over half of the stolen funds are still in the hands of the attackers. This creates a stark contrast between the exchange's internal solvency and the actual recovery of the assets.

Most coverage from Yahoo Finance and CBS News now treats the restoration of services as the primary story. These reports focus on the percentage of funds covered and the return to normalcy, effectively treating the security failure as a closed chapter.

Nov 2 · The Hacker News reports Binance cryptocurrency theft totaled $6.43 billion Updated 15:03

The Hacker News reported that the cryptocurrency theft from Binance totaled $6.43 billion, an amount that nearly doubled the total cryptoassets stolen by the North Korean regime. According to The Hacker News, approximately $2.85 billion of the stolen funds have been frozen by various blockchain entities, and the group TraderTraitor used AI-generated recruitment lures and trojanized Terraform providers to deliver malware, including ROOFDECK and FLATROOF. The Guardian reported that investors withdrew $3.6 billion from Binance following the hack and that Binance has replenished 90% of the stolen funds. CBS News reported that Binance has begun resuming withdrawals for major assets, such as Ethereum and Bitcoin, in phases.

The Hacker News provides a critical technical bridge by identifying the use of trojanized Terraform providers and AI-generated lures to deliver FLATROOF and ROOFDECK malware. This explains how the attackers bypassed security to gain the high-level access needed for a multi-chain heist, moving the explanation beyond a simple "compromised laptop" to a sophisticated developer-workflow exploit.

CBS News reports the phased resumption of withdrawals, signaling an attempt to restore operational normalcy. However, the updated figure of $2.85 billion in frozen funds from The Hacker News confirms that over half of the stolen assets remain unfrozen and potentially accessible to the hackers.

The Guardian highlights a new dimension of the crisis by reporting that investors withdrew $3.6 billion from the exchange following the hack. This indicates that despite pledges to cover losses, the event triggered a significant crisis of confidence among the user base.

Most coverage continues to prioritize the identity of the attackers and the recovery of funds. Only The Hacker News engaged with the specific malware and delivery vectors, which is the only way to resolve the contradiction between a single point of entry and the scale of the breach.

Nov 1 · FBI accuses North Korean group TraderTraitor of stealing over $6 billion from Binance Updated 04:54

The FBI has accused the North Korean hacking group 'TraderTraitor' of stealing more than $6 billion in virtual assets from Binance in an attack that occurred around October 29. The theft was investigated by the FBI, the Secret Service, and the IRS. According to the FBI, hackers used mixers and 'peel chains' to obscure the funds, and the agency has urged cryptocurrency firms to block specific addresses linked to the North Korean actors. The FBI also linked TraderTraitor to a $1.5 billion hack of Bybit the previous year. Speaking from Mar-a-Lago, President Donald Trump expressed uncertainty regarding North Korea's involvement, stating his administration is gathering information and that they would address it with North Korea if confirmed, while expressing a lack of concern. Binance announced a new proof-of-reserves snapshot to reassure users, and the NY Post reported that the company stated it has reserves to cover 90% of the loss. Richard Teng described the breach as involving evidence-deleting software, and withdrawals were expected to resume on Sunday. Crypto expert Ari Redbord noted that the funds can be tracked in real time despite the speed of the theft and explained that hackers typically attempt to launder funds through smaller exchanges to evade detection. Fox Business reported that the stolen assets were primarily converted into Ethereum for laundering through DeFi platforms. Experts have warned users to be vigilant against potential personal data breaches and follow-up fraud, and suggest that advancements in AI models, such as Claude Code, have lowered the skill barrier for hackers to identify cybersecurity flaws.

The FBI's formal accusation of TraderTraitor transforms the identity of the attackers from a private intelligence firm's attribution to a state-level criminal charge. This adds official weight to the narrative that the heist was a tool for sanction evasion.

Newsweek focuses on the mechanics of laundering, specifically the use of 'peel chains' and mixers. This shift in attention moves the conversation toward how the money is hidden rather than the unresolved contradiction of how a single laptop enabled a multi-chain breach in 20 minutes.

NY Post suggests that AI models like Claude Code have lowered the skill barrier for identifying security flaws [1]. This frames the breach not as an isolated failure of one exchange, but as part of a systemic vulnerability where AI-powered tools make traditional institutions easier targets.

Readers should now watch whether the FBI's request to block specific addresses leads to the recovery of the assets that were not frozen by stablecoin issuers.

Oct 31 · Stablecoin issuers freeze approximately $3 billion in stolen funds Updated 07:18

Stablecoin issuers Circle, Tether, Ripple, and World Liberty Financial froze approximately $3 billion of stolen funds, with World Liberty Financial specifically freezing $27 million in associated stablecoins, according to CNBC, CBS News, and Yahoo Finance. CBS News reported that the stolen funds were taken from Binance's hot wallets and that approximately $2.4 billion in Bitcoin and Ether cannot be frozen because they operate on public blockchains. CBS News further stated that the recovery of frozen funds requires seizure warrants and civil forfeiture proceedings in court. CNBC reported that hackers swapped funds for ether, used automated laundering patterns to bypass freezes, and are reportedly using professional Chinese money laundering networks to convert digital assets into fiat currency. BBC reported that experts suggest the use of AI may have enabled the sophisticated laundering patterns seen in the heist. The Washington Post reported that the attack occurred on a Thursday and that third-party analysts report hackers are attempting to split the stolen money across various digital wallets.

Binance co-CEO Richard Teng stated that the breach likely began with a compromised DevOps engineer's laptop, which allowed unauthorized withdrawal transactions, and that investigations uncovered multiple points of breach, according to KOMO News and BBC. Teng stated that 80% of the assets have since been secured, according to BBC. Binance clarified that user deposits were not impacted, according to KOMO News. Investigative journalist Geoff White stated that the theft likely occurred via phishing attacks on employees rather than a blockchain vulnerability, and that cryptocurrency security is weaker than traditional banking and lacks government guarantees, according to PBS. Yahoo Finance reported the attack involved a self-destruct mechanism. An insider described the event as the largest bank heist in human history, according to KOMO News.

Breitbart reported that Pangolin Intelligence expressed high confidence that North Korean hackers carried out the heist during a period of increased cyberattacks referred to as 'Black October'. TRM Labs and Chainalysis identified the North Korean state-backed Lazarus Group as the likely culprits, and BBC reported that the hackers allegedly used a special authorization to manipulate a Binance hot wallet to automatically move funds.

The hack triggered a market downturn where Bitcoin fell to an overnight low of $76,400 and crypto futures liquidations reached $1.57 billion, according to CoinDesk. Yahoo Finance reported the hack caused a drop in the prices of Ether, BNB, and crypto-related stocks, and stated that customer withdrawals are temporarily suspended but are expected to resume within 48 hours following testing.

Binance will cover user losses using corporate assets and its Secure Asset Fund for Users (SAFU), which CNBC reports is valued at $1.2 billion, according to Breitbart and CNBC. Fox Business reported that Binance has reserved over $6.34 billion to cover customer losses. Investment bank Compass Point expects Binance to remain solvent and capable of reimbursing users, according to CNBC. Martin Mulyadi stated that promises of reimbursement are only as strong as a company's balance sheet, according to CNBC.

Fox Business reported that President Donald Trump stated his administration is investigating the breach and expressed general concerns about the dangers of digital currencies. The U.S. Secret Service is working with private partners to trace and recover the funds, according to Fox Business. Expert Eric Schiffer warned that this event signals a future 'bloodbath' of AI-driven cyberattacks, according to Fox Business.

Binance co-CEO Richard Teng's statement that the breach likely began with a compromised DevOps engineer's laptop provides a concrete answer to the initial question about the entry point. This points to a failure of endpoint security rather than a structural flaw in authorization protocols. However, the technical contradiction between a single laptop compromise and the ability to execute a multi-chain heist in 20 minutes remains an open question.

CBS News provides a necessary reality check on the recovery effort. By distinguishing between freezeable stablecoins and decentralized assets like Bitcoin and Ether, it clarifies that $2.4 billion remains effectively beyond reach regardless of the exchange's cooperation with law enforcement.

CoinDesk shifts the focus from the crime to systemic instability by reporting that crypto futures liquidations reached $1.57 billion. This highlights how a single security failure at a dominant exchange can trigger immediate, broad market volatility.

Most outlets have accepted the laptop explanation without further scrutiny. Coverage has largely stopped pressing the exchange on the mechanics of the breach, treating the identity of the North Korean hackers as a settled fact while leaving the technical 'how' under-examined.