Binance says its security team identified and blocked 57 suspected North Korea-linked cyber threats in 2026. The exchange disclosed the tally on November 3 in its preliminary findings on the October 29 breach, which affected about $6.34 billion in digital assets.
The attempts included fake job interviews, tampered developer software, compromised browser extensions and bogus videoconferencing apps. Binance said the tactics were designed to steal credentials or install malware that gave attackers remote access.
In the campaign that led to the October 29 theft, Binance says an engineer ran malicious code disguised as a recruitment assignment in September. The attacker later used an internal AI tool to reach other employees’ devices before gaining access to the wallet signing service.
The FBI attributed the October 29 theft to North Korea’s TraderTraitor operation. Kim Yo Jong, the sister of North Korean leader Kim Jong Un, rejected the U.S. accusation.
Binance says it rebuilt the affected wallet system and internal AI tool, replaced compromised devices and revoked credentials tied to the engineers involved. It is bringing in independent security specialists to review its findings and recommend further changes.
Disclaimer: CoinScreamer is an independent media brand owned and operated by NuvexMedia LLC, publishing news, research, and market insights on digital assets and related technologies. NuvexMedia LLC invests in and collaborates with companies across the digital asset, blockchain, and technology sectors. These relationships do not influence CoinScreamer’s editorial coverage, and the publication maintains full editorial independence to provide accurate, timely, and objective information. © 2025 NuvexMedia LLC. All rights reserved. This content is for informational purposes only and should not be considered legal, tax, investment, financial, or other professional advice.
