Author: A Fox in Web3 Research Team

Translation: Deep Tide TechFlow

Deep Tide Overview: On October 29, 2026, the global cryptocurrency industry faced the largest security incident in history in terms of the amount involved. Hackers stole and laundered various token assets worth up to $6.3 billion from Binance's hot wallet in just a few hours. This astonishing scale not only far exceeded Bybit's previous theft record but also marked one of the largest single incidents of internet robbery since the birth of the internet.

However, unlike past instances where major centralized exchanges faced attacks leading to runs on deposits and years of restructuring, the industry demonstrated unprecedented collaborative resilience during this storm. From real-time alerts from blockchain detectives to Tether and Circle rapidly freezing nearly $3 billion in stablecoins within minutes, and to leading DeFi protocols like Aave decisively halting money laundering channels, a global joint interception ultimately prevented the hackers from making off with more than half of their loot.

More importantly, Binance fully covered 98% of the stolen exposure through its SAFU fund and reserves within days. The secondary crypto market not only avoided a panic but also absorbed the shock with a remarkably calm trend. This article provides a panoramic restoration of the national-level cyber warfare details involving fake interviews, new types of malware, and the abuse of internal AI tool permissions, offering an invaluable real slice for the entire industry to examine security infrastructure and defensive depth.

On Thursday, October 29, North Korean hackers stole approximately $6.3 billion in assets from Binance, the world's largest cryptocurrency exchange. This not only set a record for the largest theft in cryptocurrency history but also represented a sum four times that of the $1.4 billion stolen from Bybit in February this year.

The hackers launched a meticulous infiltration operation that lasted four months. They exploited a compromised installation package, orchestrated fake job interviews, and manipulated an AI tool already in use at Binance, ultimately breaching the protective line.

Within hours of the incident, stablecoin issuers like Tether and Circle swiftly froze billions of dollars in stolen assets. Binance officials stated they had fully compensated 98% of the stolen assets using their own funds.

Currently, Binance platform users have not suffered any financial losses, and the secondary market prices of cryptocurrencies have barely been affected. This perfectly validates that the entire cryptocurrency industry has developed unprecedented maturity and resilience in responding to major security black swan events.

The security breach targeting Binance, which involved more than $6 billion in assets, is not only the largest theft in cryptocurrency history but also likely the biggest single cyber heist in internet history. This is a historic event that is destined to be recorded in history, despite its tragically alarming process.

What is impressive is the rapid response of many core industry participants, including Circle and Tether, who swiftly froze large amounts of stolen USDC and USDT following the incident. Binance also fully compensated all the affected assets in a very short time, and the secondary market effectively absorbed this shock.

From multiple dimensions, this incident reflects the worst side of the cryptocurrency world but also demonstrates its most outstanding aspect, which is why I felt compelled to write this deep review this week.

Binance Theft of $6.3 Billion: The Largest Scale Cryptocurrency Hacker Heist

On Thursday, October 29, billions of dollars in cryptocurrency assets began to flow out of Binance's hot wallets without warning. Hot wallets are typically connected to the internet in real-time and serve as the core turnover channel for centralized exchanges to process users' daily withdrawal requests.

Within minutes of the abnormal movements, on-chain security analysts on social platform X captured unusual fund flows. Less than an hour later, the entire network confirmed: Binance was under a massive hacking attack. Binance co-founder CZ was one of the first key figures to publicly confirm the danger on social media.

Image: CZ was the first to publicly confirm on social platform that Binance was attacked by hackers

According to the loss statistics subsequently released by Binance officials, the stolen assets totaled approximately $6.34 billion, with stolen tokens spanning Bitcoin, Ethereum, Solana, Ripple, and several other major public chains.

When measured in USD, this astonishing figure unquestionably set a new record for the largest single theft in cryptocurrency history, around four times that of the $1.4 billion stolen from Bybit in February 2025.

Renowned on-chain data analysis platform Arkham quickly grouped the on-chain addresses controlled by the hackers under the same entity label. Data showed that on the day of the attack, over $5.7 billion quietly consolidated into 55 core addresses controlled by the hackers. As the hackers began to frequently transfer and split funds on-chain, this number rapidly expanded to more than 10,000 derived addresses.

Image: Arkham's on-chain tracking page aggregates the hacker-related addresses and asset distribution

This Tuesday, Binance officially released a preliminary investigation report detailing the course of the entire invasion incident. At the beginning of the report, Binance sincerely apologized: "Such a serious incident should never have happened. We deeply apologize for the concern, confusion, and uncertainty it has caused to our users, partners, and the entire industry."

Image: Preliminary investigation report and apology statement released by Binance

Method of Operation Breakdown: Four Months of Infiltration, Fake Interviews and AI Permission Penetration

This is an extremely meticulous and technically skilled national-level cyberattack. No external hacker directly stole Binance's private key; rather, the attackers spent a full four months meticulously infiltrating Binance's internal network until they were able to manipulate Binance's internal system to directly authorize withdrawal transactions.

Binance officially classified this attack as "a highly complex cross-phase joint infiltration operation" and systematically outlined four core key phases of the attackers' success:

Phase One (June): A core engineer responsible for Binance's wallet system inadvertently downloaded a maliciously altered counterfeit installation package while searching online for a popular AI programming assistance tool. Although Binance's security team quickly captured this anomaly and immediately provided the engineer with a new work laptop, the attackers successfully locked in on that engineer’s critical function within the wallet team.

Phase Two (September): The hacker group disguised themselves as a director of a Web3 project on a legitimate job recruitment website, actively recruiting and contacting a second Binance engineer. After a video interview with the fake HR representative and a second in-depth video technical interview with the fake CEO, this engineer was asked to download a so-called "programming assignment test" on their work computer. The test code contained a new malware program that had never been exposed in the wild before, successfully bypassing all endpoint security detection software deployed by Binance.

Phase Three (October 20): The attackers utilized the infected work computer as a launchpad and cleverly exploited an internal AI collaboration tool deployed by Binance, successfully horizontally penetrating and taking control of the workstations of two other core engineers. In this process, the attackers searched for and stole a high-privilege access token that granted them the privilege to freely launch and deploy software within Binance's system environment.

Phase Four (October 29): The hackers used these stolen high-risk privilege credentials to penetrate deep into the internal signing service nodes responsible for Binance's outgoing fund signatures, brazenly fabricating and signing illegal hot wallet withdrawal instructions.

The use of fake job recruitment and programming assignments for poisoned infiltration is a classic modus operandi of the North Korean hacker group that has Proven successful multiple times. Binance officials revealed that in just one year, the Binance security team has successfully intercepted 57 suspected targeted attacks from North Korean hackers, most of which employed similar techniques to this case. The reason this attack ultimately succeeded was simply that the hackers conducted a sufficiently lengthy period of stealth and probing, eventually finding the weak point in the system defense.

The actual asset theft operation began at 20:05 UTC on October 29. Five hot wallet addresses under Binance suddenly transferred 233 million XRP in bulk to the attackers' address, followed by swift theft of significant amounts of Solana, Optimism, and 18,270 Bitcoin.

On the Ethereum network, hackers even cunningly exploited the "EIP-7702" new protocol feature that was just introduced last year during the Ethereum upgrade. This feature allows regular Ethereum external accounts (EOA) to directly grant control of operations to specific smart contract code. The attackers, through the breached Binance internal signing service, directly signed full control authorization for the malicious contract they deployed, thereby usurping control of Binance's core hot wallet and quickly emptying it.

This clever technique made it extremely difficult for the Binance team to intercept on-chain after the incident. Even though Binance urgently paused the withdrawal interface for the entire exchange internally, the delegation authorizations written into the Ethereum blockchain ledger by EIP-7702 could not be quickly revoked through any single private key. The Binance tech team had to temporarily develop a complex dedicated collaborative disposal script, causing the last unauthorized illegal asset transfer to be completely halted nearly four hours after the attack erupted.

Multi-Party Lightning Strike: Stablecoin Issuers and DeFi Protocols Collaborate to Intercept

Of the stolen $6.3 billion in assets, nearly half were various stablecoins, including approximately $1.7 billion USDT and $824 million USDC. Unlike pure native crypto assets like Bitcoin or Ethereum, these stablecoins are issued by centralized entities Tether and Circle, which have the technical capacity to freeze tokens on designated on-chain addresses at the smart contract level. In this crisis, the response speed of these two issuing giants was extremely rapid.

About 40 minutes after the massive outflow of funds began, Tether officially locked the hackers' main receiving address and subsequently succeeded in freezing most of the stolen USDT assets.

Image: Tether CEO Paolo Ardoino announces the freezing of USDT in the hacker's receiving address

At the same time, Circle CEO Jeremy Allaire publicly announced that his team, "in close coordination with law enforcement agencies," urgently froze the implicated 823 million USDC.

Image: Circle CEO Jeremy Allaire announces cooperation with law enforcement to freeze 823 million USDC

According to official reports from Binance, under the coordinated efforts of multiple parties, nearly $3 billion of the stolen funds have been successfully frozen or intercepted in transit. This means that the actual amount the hackers could control and take away is less than half of their initial theft total.

The cunning hackers clearly anticipated the comprehensive freezing risk that stablecoins would soon face, racing against time on the blockchain to quickly exchange stablecoins for Ethereum (ETH) on Uniswap, as there are no centralized entities that can impose asset freezes on Ethereum. The hackers even deposited about $60 million USDT into the leading decentralized lending protocol Aave, attempting to borrow pure ETH with it as collateral.

In response to the hackers' collateral laundering actions, the Aave community and governance team quickly made the decision to urgently freeze their core lending market, suspending all new deposit and lending functions while ensuring that existing normal users could still freely withdraw and repay. Similarly, the leading lending protocol Kamino on the Solana chain also promptly suspended its related market trades out of caution.

Image: Aave official announces the emergency suspension of the core lending market to block hacker collateral lending

Granting Tether and Circle centralized control to save billions in assets at a crucial moment is exactly what pure crypto enthusiasts often criticize because it means that the assets of any ordinary user holding USDT or USDC could theoretically be frozen. However, it is undeniable that in this thrilling asset interception battle this week, such centralized intervention proved to be of critical importance for saving the market.

The True Culprit Emerges: Money Laundering Route of North Korean State-Level Hacker Group

On October 31, two days after the attack erupted, the FBI officially issued a cyber security alert, clearly attributing the attack to a North Korean state-level hacker organization, with the specific operation code named “TraderTraitor”. This hacker group was the mastermind behind earlier this year’s $1.4 billion heist at Bybit and is also a core special task branch under the more well-known North Korean hacker base “Lazarus Group”.

Image: FBI issues cyber security alert confirming the involvement of a North Korean hacker group

In fact, even before the FBI's formal notice, top blockchain analysis firms TRM Labs and Chainalysis had already locked on the traces of the North Korean hackers through precise on-chain behavioral graphs. Chainalysis even detected a strong correlation where money laundering funds from a previous $388 million hack at another major exchange Bitget in September intersected and mixed with the funds stolen from Binance, strongly confirming that both malicious cases originated from the same group.

Image: Chainalysis found mixing of funds stolen from Binance with funds lost in the September Bitget hack

According to the latest investigative information from the FBI, the attackers are currently making every effort to convert the various assets they have not yet frozen into ETH, planning to conduct token mixing and money laundering through various DeFi protocols and instant exchange services. In the Bybit case, this hacker group had previously used a cross-chain decentralized exchange protocol called Thorchain to gradually wash away most of the stolen ETH into Bitcoin. Analysts expect they will likely replicate a similar laundering route this time.

In this theft, the directly stolen 18,270 bitcoins are valued at about $1.4 billion. The hackers have dispersed these bitcoins to 19 newly generated independent on-chain addresses, with most of those addresses each holding exactly 1,000 BTC.

Given that Bitcoin cannot be forcibly frozen by anyone at the underlying architecture level, the hackers have now begun laundering some of the exchanged bitcoins, using a core technique called “CoinJoin” joint transactions to mix large amounts of bitcoins from different users, thoroughly obfuscating the original inflow and outflow paths of each fund.

TRM Labs expects that the remaining stolen assets will be traversing through major cross-chain bridges, instant exchange platforms, and OTC brokers; meanwhile, various on-chain security monitoring companies are continuously marking involved addresses to major compliant exchanges worldwide, working to block any channels that hackers may use to convert tokens into fiat currency and exit.

The History of Centralized Exchange Catastrophes: Evolution of Industry Defense and Self-Healing Ability

Regrettably, Binance is not the only victim of this wave of hacker assault. Within just a few days after Binance was attacked, the perpetrators stole approximately $46 million in assets from Brazil’s largest cryptocurrency exchange, Mercado Bitcoin; well-known on-chain detective ZachXBT also disclosed that an unnamed European crypto company supposedly suffered a massive security loss of over $106 million.

Image: Bankless reports on the four additional cryptocurrency security incidents that occurred within days of Binance's case

Additionally, some merchants using outdated versions of BTCPay (a self-hosted Bitcoin payment suite) also suffered from fund theft, while dozens of decentralized finance (DeFi) frontend websites were robbed due to domain registrar hijacking.

Although there is currently no solid evidence indicating a direct technological link between these cases, similar emergency plans once again saved the situation: Tether quickly froze the involved funds related to Mercado Bitcoin's theft, and that exchange subsequently announced that its platform customers did not suffer any actual losses.

Looking back at the history of the cryptocurrency industry, exchanges suffering hacker raids is almost a brutal evolution history that runs through the entire development of the industry:

In 2014, Mt. Gox lost approximately 650,000 to 850,000 bitcoins and declared bankruptcy, leaving thousands of victim users waiting desperately for a decade until 2024, when compensation payouts finally began.

In 2016, Bitfinex exchanged about 120,000 bitcoins, and the platform ultimately decided to implement a 36% indiscriminate haircut on all users' account balances and issued a compensation debt token called BFX.

In 2018, Japan's Coincheck was hacked, losing approximately $530 million worth of NEM tokens.

In 2019, Binance itself lost 7,000 bitcoins due to a serious security vulnerability.

In 2025, Bybit lost $1.4 billion, setting the record for the largest theft in the industry before last week.

In the early, wild days of the industry, even a hacking attack of several tens of millions of dollars often marked the complete demise of an exchange, bringing irreparable disaster to many investors. However, in the case of this $6.3 billion century storm, Binance explicitly announced it would cover all financial losses entirely, with its funds coming from a dedicated "SAFU" user asset security fund, commercial insurance fund, and the platform's own substantial financial reserves.

As of October 31, Binance officially reported that it had fully covered 98% of the stolen assets, and all deposit and withdrawal channels on the platform resumed normal operations on that Sunday.

Image: Binance CEO Richard Teng reports on the progress of full compensation and resumption of deposit and withdrawal services

All reserve dynamics and asset payment authenticity can be publicly verified in real-time on Binance’s publicly available "Proof of Reserves" on-chain audit page.

Image: Binance's Proof of Reserves transparently shows asset health in real-time

Even more shockingly, after the storm calmed down, the overall fund flow on the Binance platform not only did not experience a panic-driven exodus but recorded a considerable net inflow in the following days.

Image: CZ shares data showing net inflow of funds on the platform post-incident instead of an exodus

The performance of the entire secondary cryptocurrency market was equally surprisingly calm. Bitcoin's price only slightly dipped less than 5% after the news broke, consistently staying above the critical threshold of $76,000. The scale of liquidation due to panic in the entire network was only about $1.5 billion, which is extraordinarily small compared to the destructive liquidation of up to $19 billion during last year's "10/10 flash crash," showcasing an extraordinary capacity for market absorption.

From my personal perspective, the past week has concentrated on presenting both the darkest side of the cryptocurrency world and the most hopeful aspect of it. The darkest side lies in the fact that a hacker legion backed by state machinery could spend four months quietly infiltrating a top global crypto exchange, carrying out the largest astonishing heist in the industry’s history, and subsequently triggering multiple derivative attacks in the following days.

The most hopeful side is reflected in the impressive collaboration and self-healing ability displayed by the entire industry after the crisis erupted: on-chain detectives pinpointed the facts within an hour and alerted the entire network; stablecoin giants swiftly froze billions in stolen funds; DeFi protocols took proactive measures to cut off hackers’ cash-out routes; law enforcement agencies identified the perpetrating culprits within two days; and the victimized exchange managed to fully cover the losses through self-funding billions of dollars within days.

Even after the storm, Binance proactively disclosed a thorough and complete technical review of its attack to the entire industry, profoundly indicating: "Only by learning from the bloody lessons together can the overall defense system achieve true iterative upgrades." In the face of the increasingly ambitious and aggressive tactics of state-level hackers like North Korea, the collective defense network and emergency response speed of the entire cryptocurrency world are evolving at astonishing speeds.

Hacker attacks on centralized exchanges are a well-trodden topic, and the age-old crypto adage has never gone out of style: "Not your keys, not your coins." Binance could easily absorb the $6.3 billion loss due to its immense financial backing, but most exchanges simply cannot withstand such a deadly blow. For this reason, properly storing significant assets in independent wallets where you control the private keys remains the most unshakeable foundation for every cryptocurrency explorer in this unpredictable world.

But most importantly, the crypto ecosystem has always moved forward amid the harsh tempering and fierce trials by hackers since its inception, and with every storm it endures, it becomes more unbreakable than ever.