The $6.3 billion Binance hack started with a job offer. Binance says one of its engineers was approached through a legitimate job-hunting platform and invited to interviews with people posing as company representatives.

The interviews ended with a piece of homework. That homework carried the malware that gave the attackers their first foothold inside the exchange.

How a Coding Assignment Opened the Door

As part of the interview process, the engineer was told to download an "assignment". It contained malicious code.

That's what makes the trick clever. A take-home task is a normal step in tech hiring, and downloading and running code is exactly what a candidate expects to do. The request doesn't look strange, so it doesn't set off the usual alarms.

The infected computer was only the first step. From there, the attackers used an internal AI tool, which had also been compromised, to gain control over two other engineers. Accounts of Binance's write-up differ on what exactly they took over: one describes the engineers' laptops, another their wallets. Binance's own post on X sets out the full chain. We weren't able to read it directly, so some of the finer details remain unconfirmed.

The FBI Names North Korea's TraderTraitor

The FBI says North Korea was responsible for stealing more than $6 billion in virtual assets from Binance on or about October 29, 2026. The bureau calls this strand of North Korean hacking "TraderTraitor". Blockchain analytics firms had already reached a similar conclusion, as we reported when Chainalysis and TRM tied the hack to North Korea.

At $6.3 billion, the theft is more than four times the $1.5 billion taken from Bybit in February 2025, which was the previous record.

Where the Stolen Money Is Moving

The FBI, working with the US Secret Service and IRS Criminal Investigation, says it has seen the attackers converting stolen assets mainly into Ether (ETH). It expects them to launder the funds further through DeFi protocols and instant swap services, which let users trade one coin for another without opening an account.

The alert lists the addresses linked to the theft. It urges a range of crypto businesses to block transactions tied to them, including:

  • THORNode operators
  • RPC node operators, who run the servers that apps use to read and send blockchain transactions
  • instant exchanges
  • DeFi services
  • blockchain analytics firms and other virtual asset service providers

How much of the money has been frozen or traced so far isn't clear yet.

Withdrawals Return as Binance Rebuilds

Binance resumed withdrawals on Sunday while investigations continued. The exchange says it will spend more on AI security, including tools that can detect threats.

There's a dry twist in that plan. A compromised AI tool helped the attackers move from one engineer to two more, and part of the fix is more AI. The test now is whether those detection tools can catch something that looks as ordinary as a job applicant doing their homework.

The next thing to watch is the laundering trail. With the FBI's address list public, every swap the attackers attempt through a DeFi service or instant exchange is a chance for someone to block it.