Earlier findings pointed to a single compromised laptop belonging to a DevOps engineer, which gave the attacker access to a service container that submits withdrawals. Binance has now tied that compromise to a bogus job interview, a lure North Korea-linked groups use to get targets to run malicious code during fake hiring tests.

The theft on October 29 took about 20 minutes and drained roughly $6.3 billion from hot wallets across several blockchains. The FBI attributed it to TraderTraitor, the North Korean unit also blamed for the 2025 Bybit theft.

About $3 billion has been frozen onchain, including roughly $1.57 billion in USDT by Tether and more than $800 million in USDC by Circle.

Binance has pledged to cover every loss and set aside $6.34 billion for it. CEO Richard Teng has said the attack involved additional points of breach beyond one engineer's permissions, and a full post-mortem is still pending.