// AI threat desk · 15 Nov 2026
Home/AI-ATK · AI-Powered Attacks
AI-Powered AttacksHighCRYPTOCVSS not assigned

Binance attack took more than $6 billion in virtual assets

North Korea took more than $6 billion from Binance on or about Oct 29, the FBI said. Binance disclosed the incident on Nov 3.

· 2 min read
AI-generated image of analysts monitoring a cryptocurrency cyberattack in a dim security operations centre.
AI-generated image, not a photo of the event.
Key takeaways
  • The FBI said North Korea was responsible for taking more than $6 billion in virtual assets from Binance on or about Oct 29, 2026.
  • The activity is identified by the FBI as TraderTraitor, and the attacker drained hot wallets across 11 blockchains.
  • Elliptic verified $2.85 billion in frozen or seized funds, equal to 44% of the amount taken.

Binance lost more than $6 billion in virtual assets in an attack attributed to North Korea on or about Oct 29, 2026, the FBI said. Binance disclosed the incident on Nov 3.

The FBI said the activity involved TraderTraitor. Elliptic said the attacker drained Binance hot wallets across 11 blockchains over several hours, with the largest losses on Ethereum, where $3.80 billion was taken across 186 tokens.

Binance says North Korean hackers used a fake job interview to trick an employee into installing malware.

On this page

TraderTraitor converted assets primarily into Ether

The FBI, together with the USSS and IRS-CI, observed TraderTraitor actors converting the assets primarily into Ether, or ETH.

Elliptic said $3.80 billion was taken on Ethereum across 186 tokens, including 1.9 billion USDT and 823 million USDC.

Binance rebuilt the compromised wallet system and internal AI tools

Binance described the incident as a multi-stage campaign and said it was not a single isolated breach or a simple phishing incident.

The company said it had rebuilt the compromised wallet system and internal AI tool and replaced all affected devices. It also decommissioned compromised credentials and tokens, enhanced scans on employee devices and added AI-powered anomaly detection capabilities.

Binance co-CEO Richard Teng said the attackers “spent months building their way in.”

Elliptic verified frozen or seized funds across the incident

Elliptic said $2.85 billion of the amount taken had been frozen or seized, almost all of it USDT and USDC. Its assessment put the incident at more than four times the $1.46 billion taken from Bybit in 2025.

The FBI, USSS and IRS-CI are urging virtual-asset service providers and other listed entities to block transactions linked to addresses used by TraderTraitor to launder the assets.

Elliptic said its customers can screen against addresses linked to the incident and that its free blocklist now contains more than 8,000 addresses. Whether laundering automation involved AI agents rather than conventional scripts could not be determined from on-chain data.

What to do now

  1. Block transactions with or derived from addresses TraderTraitor actors are using to launder the assets.

FAQ

What happened to Binance on Oct 29, 2026?

The FBI said North Korea was responsible for taking more than $6 billion in virtual assets from Binance on or about Oct 29, 2026. Elliptic said the attacker drained Binance hot wallets across 11 blockchains.

Who was behind the Binance incident?

The FBI attributed the activity to North Korea and refers to the specific malicious cyber activity as TraderTraitor.

How much Binance cryptocurrency was frozen or seized?

Elliptic verified $2.85 billion in frozen or seized funds, representing 44% of the amount taken.

How did the attackers enter Binance?

Binance says North Korean hackers used a fake job interview to trick an employee into installing malware. Richard Teng said the attackers spent months building their way in.

Did AI agents launder the Binance assets?

Elliptic said whether the laundering automation involved AI agents rather than conventional scripts could not be determined from on-chain data.

Sources

  1. Binance says fake job interview led to $6.3 billion crypto heist, HKCERTPrimary
  2. North Korea Responsible for $6 Billion+ Binance Attack | Federal Bureau of Investigation, FBIPrimary
  3. The largest theft in history: North Korea behind the $6.4 billion Binance hack | Elliptic, EllipticPrimary
  4. North Korean fake job interview led to $6.3B Binance heist, The Register
  5. Binance co-CEO Richard Teng says hackers used fake job interviews, AI tool to steal $6.3 billion in crypto, CNBC
  6. Binance attackers used fake job interviews to pull off $6.3 billion crypto heist, Engadget
How we checked this story
ClaimSourceStatus
Binance says North Korean hackers used a fake job interview to trick an employee into installing malware.Binance, via HKCERTAttributed
The FBI said North Korea was responsible for stealing more than $6 billion in virtual assets from Binance on or about October 29, 2026.FBIConfirmed
The FBI refers to the specific North Korean malicious cyber activity as TraderTraitor.FBIConfirmed
The FBI observed TraderTraitor actors converting stolen assets primarily into Ether.FBIConfirmed
Elliptic said $6.43 billion in cryptoassets was stolen from Binance on October 29, 2026.EllipticConfirmed
Elliptic said the FBI attributed the theft to North Korea and named TraderTraitor.EllipticConfirmed
Elliptic verified $2.85 billion of frozen or seized funds, representing 44% of the theft.EllipticConfirmed
The attacker drained Binance hot wallets across 11 blockchains over several hours.EllipticConfirmed
Elliptic said the largest losses were on Ethereum, where $3.80 billion was taken across 186 tokens.EllipticConfirmed
The Register reported that Binance described the breach as a sophisticated, multi-stage campaign rather than a single isolated breach.Binance, via The RegisterAttributed
The Register reported that Binance rebuilt the compromised wallet system and internal AI tool and replaced affected devices.Binance, via The RegisterAttributed
CNBC reported that Binance co-CEO Richard Teng said attackers spent months building their way in.Richard Teng, via CNBCAttributed
Engadget reported that Binance had frozen $2.85 billion of the $6.34 billion in impacted digital assets.Binance, via EngadgetAttributed
Engadget reported that Binance had rebuilt affected systems, replaced devices, decommissioned compromised credentials and tokens, and enhanced security scans.Binance, via EngadgetAttributed
Elliptic said whether the laundering automation involved AI agents rather than conventional scripts could not be determined from on-chain data.EllipticConfirmed
Elliptic said customers can screen against addresses linked to the incident and that it published a free blocklist containing more than 8,000 addresses.EllipticConfirmed
HKCERT published its report on Nov 3, 2026.HKCERTConfirmed
fbi.gov published its report on Oct 31, 2026.fbi.govConfirmed
elliptic.co published its report on Oct 30, 2026.elliptic.coConfirmed

Could not verify

  • Whether Binance assigned a CVE to the incident is not established.
  • Whether the attackers exploited a software vulnerability is not established.
  • How many Binance customers or accounts were affected is not established.
  • Whether the internal AI tool itself contained a security flaw is not established.
See all in AI-Powered Attacks →
Explore with AI
ChatGPT
Claude
Perplexity
Grok