Binance Hackers Sat Inside Exchange for Eight Weeks Before $6.3B Drain

The hackers who took roughly $6.3 billion from Binance on October 29 had access to the exchange's internal systems for about eight weeks before they struck, according to research into the incident cited in reporting on the breach. The theft itself took roughly 20 minutes. The intrusion began no later than June 2026.

That gap is the uncomfortable part. The largest digital asset theft on record wasn't a smash-and-grab. It was a slow, quiet occupation followed by a coordinated sprint across more than ten blockchains, including Ethereum, Bitcoin, and Solana.

How the attack actually unfolded

The drain started around 20:05 UTC on October 29. Most of it played out inside a 20-minute window. Moving funds across that many networks at once takes rehearsal, not luck.

The timeline shows the rehearsal. On October 20, roughly 36 hours before the theft, the attackers reportedly tested their internal access. Binance's own investigation traced the breach to a multi-layered social engineering campaign. The tactics included a fake job interview and tampered software development tools.

Those methods opened the door to Binance's internal systems. From there, the attackers could push unauthorized transactions through the approval pipeline. Notably, they never compromised private keys — the cryptographic credentials usually treated as the crown jewels of exchange security. They didn't need them. If you can operate inside the systems that authorize transactions, the keys stop being the bottleneck.

The breach has been attributed to TraderTraitor, a North Korean state-sponsored hacking group. The same group is linked to the $1.5 billion theft from Bybit in February 2025, which was, at the time, a landmark loss for a centralized exchange. The Binance figure is more than four times larger.

What did Binance do next?

Binance paused withdrawals immediately after the theft and later restored them in phases. It allocated approximately $6.34 billion from corporate resources to cover losses, and by October 31 said about 98% of stolen assets had been replenished.

Partners and stablecoin issuers stepped in too. Roughly $2.85 billion to $3 billion of the stolen funds were frozen or intercepted. Stablecoin issuers can lock tokens at the contract level, rendering a portion of the loot unusable for the thieves.

Binance has also commissioned an independent security review. Its stated purpose is to analyze the breach and strengthen the exchange's resilience going forward. The eight-week dwell time will draw the most scrutiny in that review, because detection — not just prevention — is where the failures appear to sit.

A familiar playbook, scaled up

North Korea-linked hackers have refined one approach to crypto targets over years: patient infiltration, human manipulation, then a fast exit. The Binance case fits the pattern exactly.

Fake job interviews are a particularly effective lure. A developer who believes they're completing a technical assessment may run code or install tools without the scrutiny they'd apply to an unknown file. Tampered development tools extend the same idea. Engineers trust their toolchains, and that trust becomes the entry point.

What does this change for exchanges and users?

For exchanges, the clearest lesson is operational: hot wallet security is only as strong as the internal systems that can authorize transactions from those wallets. Protecting private keys is necessary but plainly not sufficient when an intruder can operate inside the approval pipeline undetected for two months.

The partial freeze of $2.85 billion to $3 billion highlights a second shift. Stablecoin issuers and partner firms now function as a de facto emergency brake on large thefts, freezing stolen tokens at the contract level before they can be laundered. That strengthens the case for centralized intervention tools that parts of the crypto industry still resist.

For users, the practical takeaway extends beyond Binance. Funds on any centralized exchange depend on that exchange's internal controls, its reserves, and its ability to absorb a hit when those controls fail.

Binance had the reserves this time. The open question for the industry is how many other platforms could say the same if a group with weeks of quiet access chose them next — and whether the independent review's findings, when published, set a new baseline for detection standards across centralized exchanges.