Binance Hack: What We Know About Lazarus Group
2026-11-09 by Trevor Kamau
The Binance hack of 29 October 2026 took about $6.3 billion in crypto in roughly 20 minutes, the biggest theft in crypto history. The FBI blames TraderTraitor, a North Korean unit that analysts link to the Lazarus Group, and Binance says the break-in began with a fake job interview. Checked 9 November 2026.
What happened to Binance
Late on Thursday 29 October 2026, an attacker moved roughly $6.36 billion out of Binance wallets on ten blockchains, most of it in about 20 minutes, according to blockchain analysts TRM Labs as reported by CBS News. Binance has talked about $6.34 billion, and AP-based reports say $6.3 billion. The amounts differ slightly because outlets count tokens at different prices.
Binance froze withdrawals, then reopened them in stages from 1 November. It says customer money is safe because it is paying for the loss itself, using its user protection fund, an insurance fund and company cash, as CNBC reported. Binance says about 98 percent of the affected assets have been replaced. Reports put the amount frozen by Binance and its partners at roughly $2.5 billion to $3 billion. Frozen is not the same as recovered, so treat those figures with care.
Who is the Lazarus Group, and why is it blamed?
Lazarus Group is the name security researchers use for a large cluster of hackers working for North Korea. A joint US government advisory from 2022, from the FBI, CISA and the Treasury, says a sub-group called TraderTraitor is commonly tracked under that same Lazarus name, and that it has gone after crypto firms since at least 2020.
For this case, TRM Labs said it had high confidence in TraderTraitor, and Chainalysis called it likely. The FBI then said on 31 October that North Korea was responsible and that it saw the thieves converting loot into Ethereum, according to Infosecurity Magazine. It added that the funds were being prepared for further laundering. North Korea has denied involvement, according to the summary of the case on Wikipedia. The attribution comes from the FBI and private analysts, and Binance has not published a final report yet.
How the attackers got in
Binance published its first findings on 3 November. Fortune summarised them, and the story is less about clever code than about people.
In June, one wallet engineer clicked an ad and installed a tampered version of a popular developer tool called Homebrew. Binance caught it, but the attackers had learned who worked on wallets. In September, a different engineer was approached on a job platform by someone posing as a recruiter. He went through two interviews, one with a fake HR person and one with a fake CEO, and was then asked to download a coding assignment onto his work laptop. That file carried malware.
From that laptop, Binance says the attacker used an internal AI tool to reach two other engineers. One of them had a permission token on his computer that let the attacker reach the system that signs wallet transactions. Binance says it found no evidence that wallet private keys were leaked. The attacker instead sent instructions to a service that approved them.
What this means if you look for online work
Fake recruiters are not only a problem for big companies. Anyone applying for remote jobs can get the same message, with the same script: a friendly interview, then a file to download to complete a test. Safaricom itself lists fake job opportunities among the scams to watch for.
- Never open an interview "assignment" on the computer you use for money, email or work.
- Check the company and the recruiter on the official company site, not only on the chat or the profile that contacted you.
- Do not install anything a recruiter sends. A real test runs in your browser or on a platform you chose.
- Use our scam check before you share a document, selfie or download.
- Lock down your own login first with our guide to securing your Gmail and Google account, since email is the key to every other account.
What this means if you hold crypto
This was a theft from the exchange itself, not from individual customers, and Binance says it will absorb the loss. That is a company promise, not a legal guarantee, so the lesson is general. Do not keep more on any exchange than you are ready to see frozen for a few days, and keep long-term savings in a wallet you control. This is education, not financial advice, and crypto can lose value quickly: Bitcoin fell almost 5 percent on the news.
Read more about earning and staying safe online on our start here page.
What we could not confirm
We could not confirm who exactly carried out each step, the final amount stolen, how much will be recovered, or whether more breach points exist. Binance has said more details will follow, and we will update this story when they do. Reports linking the group to Russia come from a single outlet, so we left them out.
The short version
Binance lost about $6.3 billion on 29 October 2026, the FBI blames a North Korean unit tied to Lazarus Group, and Binance says it began with a fake job interview and a malicious coding test. Be careful with any recruiter who asks you to download something.