North Korea’s regime-linked hackers pulled off the largest theft of digital money in history, stealing more than $6 billion from the world’s biggest crypto exchange using nothing more than a fake job interview.
Story Snapshot
- The Federal Bureau of Investigation (FBI) blamed a North Korean state-backed hacking group called TraderTraitor for stealing $6.3 billion from Binance.
- Hackers posed as recruiters, lured a Binance engineer with a fake coding test, and used stolen credentials to break into wallet systems.
- More than 233 million units of one cryptocurrency were drained from five Binance wallets in just four minutes.
- North Korea has denied any involvement, and roughly $3 billion has since been frozen.
A Record-Breaking Theft Hits Crypto’s Biggest Exchange
Binance, the world’s largest cryptocurrency exchange, confirmed hackers stole approximately $6.34 billion in digital assets in a multi-stage operation that ended on October 29. The attack easily outpaced the previous record, a $1.5 billion theft from a Dubai-based exchange last year. The Federal Bureau of Investigation (FBI) publicly attributed the theft to North Korea and named the hacking unit responsible: TraderTraitor.
Binance said the attack moved fast once hackers got inside. The Globe and Mail reported that 233.46 million units of XRP, a digital currency, vanished from five Binance wallets in just four minutes. Other cryptocurrency withdrawals followed right after. This wasn’t a slow leak. It was a lightning raid against one of the most heavily guarded vaults in the financial world.
A Fake Job Offer Opened the Door
Binance says the breach started in September with an old-fashioned con dressed up in modern tech. A hacker posing as a project director contacted a Binance engineer through a real job platform. He set up fake interviews with supposed company representatives, then sent a coding assignment loaded with hidden malware. The engineer, simply doing what his job required, downloaded it and unknowingly let the enemy inside.
From there, attackers used stolen login credentials to plant a malicious script, giving them a path into Binance’s wallet-signing system, the digital vault keys that move customer money. BleepingComputer reported that this access chain let hackers quietly work their way toward the exchange’s most sensitive financial controls before striking. It’s a sobering reminder that even billion-dollar security systems can fall to one well-placed lie.
This Wasn’t North Korea’s First Rodeo
This fake-interview trick isn’t new. U.S. cybersecurity officials have tracked TraderTraitor since at least 2020, describing a consistent playbook: fake recruiters target crypto developers and system administrators, dangle high-paying jobs, and slip malware into what looks like ordinary work files. North Korea, a regime crushed by international sanctions and desperate for cash, has turned cryptocurrency theft into a core funding strategy for its government.
Analysts tracking North Korean crypto crime say Pyongyang stole at least $6.75 billion in digital assets through the end of 2025, a tally that already included the earlier $1.5 billion exchange hack and a separate $387 million theft from another platform. The Binance heist simply became the newest and biggest entry on that growing list, confirming a pattern American officials have warned about for years.
Money Frozen, Denials Issued
Binance reported that roughly $3 billion of the stolen funds has since been frozen, and the exchange says it plans to repay affected customers. That leaves the final, confirmed loss still being sorted out. North Korea, for its part, has flatly rejected the FBI’s accusation, a denial that has become standard practice for a regime with a long history of cyber theft and an equally long history of lying about it.
CYBERSECURITY BREAKING: FBI and DOJ secure court authorization to seize over $1.2 billion in cryptocurrency stolen in the record $6.3 billion Binance heist linked to North Korea's TraderTraitor hackers.
Read full breakdown: https://t.co/5VNPDN87It pic.twitter.com/AcXZllAZ4D
— Consilva Business Magazine (@consilva_) November 13, 2026
None of this changes the basic facts on record: a hostile communist regime used deception and stolen credentials to rob a major financial platform of billions in American and global investor money. For a White House focused on holding rogue states accountable and protecting American financial interests from foreign cybercrime, this heist is another hard lesson in why vigilance against North Korea’s digital warfare can never let up.
Sources:
nbcnews.com, nextgov.com, thehill.com, hcamag.com
