Co-CEO Yi He disclosed the figure in an incident report that followed a major October breach tied to the TraderTraitor group
Binance says its security team stopped 57 suspected North Korea-linked cyber threats over the course of 2026. Co-CEO Yi He shared the figure on November 3.
The timing is awkward. The number surfaced in a detailed incident report published after a breach on October 29, one that reportedly took approximately $6.34 billion in digital assets from the exchange.
So the scoreboard reads 57 attempts blocked and one that got through. In this line of work, a single miss can carry a ten-figure price tag.
What Binance disclosed
The report lays out how the attackers tried to get in. The playbook leaned on people as much as on code.
Tactics cited included social engineering, tampered software packages, and fake job interviews. The goal in each case was the same: obtain unauthorized access to sensitive information and plant malware on internal systems.
Binance attributed the October 29 incident to North Korea’s TraderTraitor group. The FBI and blockchain analytics firms have also linked the theft to the same unit, according to the research findings.
TraderTraitor is not a new name in crypto security circles. The group has been tied to earlier high-profile thefts, including the Bybit hack in February 2025.
The response and the fallout
After the breach, Binance moved to contain the damage. The exchange froze or intercepted roughly $2.85 billion of the stolen assets.
Binance has pledged to replenish any affected user assets, which, if honored in full, shifts the loss from customers onto the company’s balance sheet.
Withdrawals were paused in the immediate aftermath. The exchange began restoring them in phases starting November 1, 2026.
North Korea, for its part, rejected the accusations. Kim Yo Jong dismissed the claims of involvement as “absurd rhetoric.”
A campaign, not a one-off
Blockchain analytics firms including TRM Labs, Chainalysis, and Elliptic have described North Korea’s activity against the crypto industry as a strategic campaign. According to the research findings, those firms see the effort growing more sophisticated and more urgent.
Cyber theft has become a significant source of revenue for North Korea’s weapons programs, according to the research findings.
The volume alone tells a story. Fifty-seven suspected cases across a single year works out to more than one serious attempt per week, aimed at one exchange.
What this means for exchanges and users
Binance’s pledge to cover losses is the critical variable for its own customers.
The attack methods also matter for the wider industry. Social engineering and fake hiring schemes target employees, which means firewalls and audits only go so far. Hiring practices, developer onboarding, and dependency management are now frontline security concerns.
The 57 blocked cases cut both ways as a disclosure. On one hand, they show a security team catching a steady stream of attempts. On the other, they show how relentless the pressure is, and how one success can outweigh dozens of defensive wins.
For users, the lesson is less about any single platform and more about exposure. Funds held on an exchange depend on that exchange’s defenses holding every time, against an adversary that only needs to win once.
Things to watch from here include how quickly Binance completes its phased withdrawal restoration, whether more of the stolen assets are frozen or recovered, and how the exchange funds its replenishment pledge.
