Skip to content
North Korean Hackers Steal $6.3 Billion from Binance Using Ethereum Exploit

North Korean Hackers Steal $6.3 Billion from Binance Using Ethereum Exploit

First seen 6 Nov 2026, 17:17 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •November 6, 2026 at 17:18 UTC
  • •Hackers stole $6.3 billion from Binance using a sophisticated multi-stage attack.
  • •They exploited Ethereum's EIP-7702 feature to transfer $2.5 billion in one transaction for only $15.
  • •The FBI attributes the attack to North Korean hackers, who deny involvement.

On October 29, 2026, hackers believed to be from North Korea executed a sophisticated cyber heist, stealing approximately $6.3 billion from Binance, the world's largest cryptocurrency exchange. The attackers exploited Ethereum's EIP-7702 feature to gain control of a hot wallet after deceiving an engineer into downloading malicious software via fake job postings. They paid just $15 in network fees to authorize their software to transfer approximately $2.5 billion in a single transaction, representing 40% of the total stolen funds. Binance has since tightened its security measures and is working to recover the stolen assets. The FBI has attributed the attack to North Korea, which has denied involvement. This incident marks one of the largest thefts in cryptocurrency history.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 1d ago How this analysis works

Timeline

2026-10-29
Massive theft from Binance
Hackers executed a sophisticated attack, stealing $6.3 billion from Binance using EIP-7702 to transfer $2.5 billion in one transaction.
Straitstimes
2026-11-03
Binance outlines attack details
Binance reported on the attack's timeline, revealing how hackers used fake job postings to compromise an engineer's laptop.
Straitstimes

More articles in this cluster (6)

Following this threat?

Track Binance in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (5)

1 / 2

Common questions

How did the hackers gain access?
The hackers tricked a Binance engineer into downloading malicious software through fake job postings.
What measures is Binance taking post-attack?
Binance has tightened its security protocols and is working to recover the stolen funds.
Is this attack linked to previous incidents?
Yes, the FBI has linked this attack to North Korean hacking groups known for similar cyber operations.