Skip to main content
CadNews - Comparative News Analysis
Topics
Sign in
Back to brief

Crypto · November 3, 2026

Binance Says Hackers Plotted $6.3 Billion Crypto Heist for Months

4 sources →

FreeGet stories like this compared, every morning at 7.

According to the company, the operation began in June and involved a monthslong campaign of fake job interviews and social engineering. An engineer inadvertently downloaded malware that allowed attackers to infiltrate the company's network, exploit an internal AI tool, and access wallet signing services. Although billions were siphoned in a 20-minute window, Binance reported that roughly half of the targeted funds have been frozen or intercepted. The FBI has attributed the attack to North Korean cybercriminals, a claim Pyongyang has denied.

Read the original coverage

Hype check

How the hype check works

Confirmed · 2

Backed by filings, on-chain data, official statements or several independent publishers.

  • The heist involved a fake job interview and malware download. (Binance)
  • Attackers gained access to a wallet signing service. (Binance)

Claimed · 2

Said by a company, project or person; not yet independently confirmed.

  • Funds have been set aside to cover the losses. (Binance)
  • Internal systems impacted in the attack have been rebuilt or replaced. (Binance)

Speculation · 1

Price talk, forecasts or unnamed sources, quoted as someone else's view.

  • North Korean cybercriminals are responsible for the heist. (The FBI)

Reported by multiple outlets

  • The hackers used fake job interviews and recruitment scams to compromise a Binance engineer.
  • Attackers exploited an internal AI tool and a wallet signing service to facilitate the theft.
  • The infiltration involved the use of malicious software (malware).
  • Binance issued a security update on Tuesday detailing the findings.
  • The hackers were able to move through the network and execute transactions outside of normal withdrawal procedures.

Reported by only some outlets

  • The Guardian reports the operation began in June and included a recruitment scam in September.
  • Wired and The Guardian note that the FBI or 'suspected' attackers are linked to North Korea.
  • Wired reported the heist occurred in just 20 minutes.
  • Binance says it has set aside funds to cover losses and has rebuilt impacted systems, as reported by Wired.

FreeDaily Brief newsletter

Get the 5-minute Daily Brief, with the topics you pick.

The Daily Brief is free

About these outlets

CadNews does not determine absolute truth or endorse political viewpoints. It compares publicly available reporting, identifies shared facts, highlights framing differences, and flags uncertainty.