The Binance logo is seen on a smartphone, Feb. 28, 2023, in Marple Township, Pa. (AP Photo/Matt Slocum)
In a report published Nov. 3, Binance said the theft was the final stage of a campaign that began in June. The company reported that the attackers used a fake job interview and tampered software to infiltrate engineers’ computers over several months, then took control of a third engineer’s machine to drain the funds.
Customers withdrew a net $4.72 billion after the heist on Nov. 1, roughly 3% of its assets. However, Binance said it would “absorb” the cost of the theft so users aren’t harmed, and by Nov. 3 it said hourly deposits had begun to exceed withdrawals. Co-CEO Richard Teng said that outflows had “pretty much normalized” after an initial spike and that Binance had replenished 95% of the affected tokens by buying replacements with its own funds. Matt Hougan, chief investment officer at Bitwise Asset Management, further noted that hot wallet hacks have “historically not had a meaningful impact” on crypto returns. A hot wallet is a wallet connected to the internet that an exchange uses to process customer withdrawals.
Against U.S. claims, North Korea has denied them. In a statement carried by state media on Tuesday, Kim Yo Jong, senior ruling-party official and sister of leader Kim Jong Un, called the accusation a political provocation, branding North Korea as a “cyber criminal state.” She said Pyongyang would “reconsider” unspecified matters in response to what she described as U.S. hostility, a warning that comes as Trump has sought to revive summit talks, calling the US investigation an “absurd rhetoric”.
It is not the first time the FBI has pinned a major crypto theft on TraderTraitor. In February 2025, the group was blamed for stealing about $1.5 billion from the exchange Bybit, the largest crypto heist on record until the Binance theft. TraderTraitor has also been linked to the $308 million DMM Bitcoin theft in May 2024. The group first appeared publicly in an April 2022 advisory from the FBI, the Cybersecurity and Infrastructure Security Agency, and the Treasury Department, and has used trojanized cryptocurrency applications to infect victims’ computers since at least 2020. U.S. authorities also track the group as part of North Korea’s Lazarus Group, whose thefts, officials say, help fund Pyongyang’s weapons programs.
In this photo provided on Oct. 30, 2026, by the North Korean government, its leader Kim Jong Un, center right, and his daughter, center left, watch the demonstrations held at an exhibition of a variety of attack and other drones at the Wonsan-Kalma coastal tourist area, North Korea, Thursday, Oct. 29, 2026. Independent journalists were not given access to cover the event depicted in this image distributed by the North Korean government. The content of this image is as provided and cannot be independently verified. (Korean Central News Agency/Korea News Service via AP)
Experts in Seoul suggested Pyongyang’s quick denial reflects concern that the allegation could prompt tougher measures against sources of funding that support its arms development. Lim Eul-chul, a professor at Kyungnam University's Institute for Far Eastern Studies, explains that, with heavy sanctions in place, cryptocurrency hacking has been a major way for North Korea to support the regime and its arms. Analysts estimated that North Korea has stolen cryptocurrency worth US $7.6 billion this year, more than in any previous year.
The theft also highlights a broader industry challenge. Security experts note that exchanges with thousands of employees have “numerous potential entry points,” and that companies can only do so much against repeated attacks without a government response. As crypto grows closer to banks and mainstream finance, the Binance hack shows that human intermediaries are still central to controlling who can move assets. To address this issue, Binance said it will spend more on AI-based threat detection and is working to set up a security research fund, along with joint projects with major AI companies.