Binance Counters North Korea-Linked Cyber Threats After $6.34B Breach

Co-founder and co-CEO Yi He revealed that the October 29 security breach stemmed from sophisticated social engineering. Attackers targeted employees via fake job interviews, malicious software packages, and fraudulent developer tools. In one instance, a software engineer was tricked into downloading a compromised assignment that bypassed endpoint security, providing hackers the credentials necessary to penetrate internal wallet-signing operations.

Following the intrusion, Binance launched an aggressive recovery effort, currently reporting that 98% of stolen tokens have been replenished using corporate reserves and the Secure Asset Fund for Users. The remaining assets, which are less liquid, are being acquired incrementally. While US federal agencies including the FBI and IRS have formally attributed the attack to North Korean actors, the state has denied any involvement. Meanwhile, blockchain analytics firm Elliptic continues to track the laundered funds, noting that while billions remain in attacker-controlled wallets, significant portions of the stolen Bitcoin have already been funneled through CoinJoin services.