Binance hackers reportedly spent eight weeks inside before $6.3 billion theft

The hackers who took approximately $6.3 billion from Binance on October 29 reportedly had access to the exchange for eight weeks before they acted.

The theft itself was quick. The setup was not, and that gap is the most uncomfortable part of the story.

The heist hit Binance’s hot wallets and ranks as the largest digital asset theft to date.

Twenty minutes of action, weeks of patience

The attack began around 20:05 UTC on October 29, 2026. Most of it unfolded within roughly 20 minutes.

In that window, the attackers moved across more than ten blockchains, including Ethereum, Bitcoin, and Solana. Running a coordinated drain across that many networks takes planning, not improvisation.

The preparation reportedly stretched back much further. Research into the incident points to a preparation period that began no later than June 2026.

The timeline also includes specific steps on October 20. Testing of internal access reportedly took place approximately 36 hours before the attack.

How they got in

Binance’s investigation found the breach came from a multi-layered campaign built on social engineering. The tactics included a fake job interview and tampered software development tools.

Those methods let the attackers into Binance’s internal systems. From there, they could push through unauthorized transactions.

Notably, they did not need to compromise private keys. Private keys are the cryptographic passwords that control crypto wallets, and they are usually treated as the crown jewels of exchange security.

The breach has been attributed to TraderTraitor, a North Korean state-sponsored hacking group. The same group is linked to earlier attacks, including the $1.5 billion theft from Bybit in February 2025.

That Bybit incident was, at the time, a landmark loss for a centralized exchange. The Binance figure is more than four times larger.

Binance’s damage control

Binance paused withdrawals immediately after the theft. It later brought them back in phases.

The exchange allocated approximately $6.34 billion from corporate resources to cover the losses. By October 31, Binance indicated that about 98% of the stolen assets had been replenished.

Partners and stablecoin issuers also stepped in. Roughly $2.85 billion to $3 billion of the stolen funds were frozen or intercepted.

Stablecoin issuers can lock tokens at the contract level, which turns a portion of the loot into something closer to Monopoly money for the thieves.

Binance also commissioned an independent security review. Its stated purpose is to analyze the breach and strengthen the exchange’s resilience going forward.

A familiar playbook at a bigger scale

North Korea-linked hackers have spent years refining a specific approach to crypto targets. The Binance case fits the pattern: patient infiltration, human manipulation, then a fast exit.

Fake job interviews are a particularly effective lure. A developer who believes they are completing a technical assessment may run code or install tools without the scrutiny they would apply to an unknown file.

Tampered development tools extend the same idea. Engineers trust their toolchains, and that trust becomes the entry point.

What this means

For exchanges, the clearest lesson is that hot wallet security is only as strong as the internal systems that can authorize transactions from them. Protecting private keys is necessary but plainly not sufficient when an intruder can operate inside the approval pipeline.

The reported eight-week access period will likely draw the most scrutiny. Detection, not just prevention, is where the independent review will need to deliver answers.

The partial freeze of roughly $2.85 billion to $3 billion highlights another dynamic. Stablecoin issuers and partner firms now act as a de facto emergency brake on large thefts, which strengthens the case for centralized intervention tools that some in crypto still resist.

For users, the practical takeaway is less about Binance specifically and more about how custody works. Funds on any centralized exchange depend on that exchange’s internal controls, its reserves, and its ability to absorb a hit when those controls fail.

Binance had the reserves this time. The open question for the industry is how many other platforms could say the same if a group with weeks of quiet access chose them next.