Binance security breach_ Company freezes Rs 60,000 cr in assets, says it will cover all losses
Binance has been making headlines since last week after it suffered a major security breach that led to an estimated loss of $6.34 billion (around Rs 60,000 crore). The cryptocurrency exchange has now shared a detailed report explaining how the attack happened and how hackers gained access to its systems. According to Binance, the attackers used fake job interviews, malicious software and compromised internal tools to target employees before reaching its wallet systems. The company has also confirmed that the attack has been linked to North Korea, citing information released by the Federal Bureau of Investigation (FBI).
In its detailed report shared on X (formerly Twitter), Binance said the attackers used a multi-stage plan. The campaign involved social engineering, malware disguised as legitimate software and stolen employee credentials.
In September, the attackers contacted a Binance software engineer through a job-hunting platform. They pretended to represent a company and arranged two online interviews. During the second interview, the engineer was asked to download a coding assignment onto his work computer.
https://t.co/sU9dUqLQDH
— Binance (@binance) November 3, 2026
However, the assignment contained malicious code. Once installed, the malware allowed attackers to run commands and communicate with an external server controlled by them. It also helped them hide their activities and remove traces of the attack.
Binance said the hackers later used the compromised computer and an internal AI tool to gain access to other employees and their credentials. This eventually gave them a way into the company’s wallet signing system.
On October 29, the attackers used unauthorised access to initiate transactions from Binance’s hot wallets. Between 20:05 UTC and 20:09 UTC, five wallets transferred around 233.46 million XRP to attacker-controlled addresses. Other transfers involved Solana and Optimism.
The final unauthorised transfer of around 2,961.9 ETH was completed at 23:56 UTC.
Binance said the incident affected approximately $6.34 billion in digital assets. However, the company assured users that they would not have to bear the financial loss.
“Our first responsibility is to protect users. Binance will absorb the financial impact of the stolen funds, not our users,” the company said in its post.
As of October 31, Binance had replenished 98 per cent of the affected token assets. It also said around $2.85 billion in assets had been frozen or intercepted.
The exchange has rebuilt affected systems, replaced compromised devices and revoked credentials linked to the incident. It has also strengthened security controls and introduced better AI-based monitoring to detect suspicious activity.
Binance said it is bringing in independent cybersecurity experts to review the incident. The company also plans to invest more in AI security.
The investigation is still ongoing, and Binance said it would share further updates as more information becomes available.