US$6.3bn: Binance’s estimate of the loss, a record for a crypto theft
US$2.85bn: frozen or intercepted so far
About US$1bn: Binance’s own user protection fund before the hack
95%: share of affected funds Binance says it has replaced
57: North Korea-linked attacks Binance says it blocked earlier in 2026
In September, a Binance software engineer was approached about a new job. Six weeks later, code he had downloaded for the recruiter’s take-home test helped attackers make off with about US$6.3bn, the largest crypto theft on record.
The world’s biggest crypto exchange set out the sequence in an incident report published on 3 November. The FBI has attributed the attack to TraderTraitor, a North Korean state-backed hacking group; Pyongyang denies any involvement. Binance also had no cyber insurance to claim on, Bloomberg Law reported, citing a person familiar with the matter.
The first break-in came in June. A staff member setting up an AI coding assistant downloaded a tampered installer, which told the attackers who at Binance worked on its wallet systems.
In September, someone posing as a project director at a non-existent company contacted a second engineer through a legitimate recruitment site. A fake HR representative then interviewed him by video and pointed him to a social media profile full of personal photos, Binance’s chief security officer Jimmy Su told reporters. The coding assignment he downloaded contained malicious code.
On 20 October, the attackers used his laptop and an internal Binance AI tool to take over the computers of two engineers on the wallet team. Binance has not said what the tool does or how it was misused. On 29 October, they used stolen credentials to launch a container and run a script that moved funds out of Binance’s hot wallets, the internet-connected wallets that process customer withdrawals.
“This should not have happened,” Binance said in an apology to users. Co-chief executive Richard Teng said on X that the company had published the full report so that other firms could learn from it.
Read next: The Binance heist took 30 minutes. The groundwork took days
Fake recruitment is one of North Korea’s best-documented techniques. Palo Alto Networks tracks it as “Contagious Interview.” The regime also runs the reverse scheme, placing its own operatives in remote IT jobs at Western companies.
In 2022, a fake job offer to an engineer at Axie Infinity preceded a theft of about US$600m. In February 2025, hackers took about US$1.5bn from Bybit, the previous record, and the FBI blamed TraderTraitor for that attack too.
The raids are growing. TRM Labs estimates that North Korea-linked groups took about 76% of all crypto hack value in the first four months of 2026. Binance says it blocked 57 suspected North Korea-linked attempts this year before this one got through.
Binance holds directors’ and officers’ (D&O) cover for executives who may face investigations or lawsuits over the hack. According to Bloomberg Law, it has not been able to buy cyber insurance, a position it shares with many crypto firms. Binance has not commented on its cover.
The policies it might have bought often exclude this kind of loss anyway. Standard crime wordings were drafted for cash and securities, and most cyber wordings exclude the loss or transfer of funds unless digital-asset cover is added, Reuters noted in its guide to crypto insurance. Christopher Keegan of Brown & Brown told Bloomberg Law that specie policies can protect coins held offline in cold storage, but typically do not respond to tokens stolen from hot wallets in a hack.
The FBI’s attribution raises a further question. Once a government names a state actor, war and state-backed attack exclusions come into play. Lloyd’s Market Bulletin Y5381 has required standalone cyber policies written in the market to carry such exclusions since March 2023, though it is unclear whether a theft from a private exchange meets the bulletin’s threshold. “State sponsorship does not automatically eliminate coverage,” said Alana McMullin, a policyholder-side partner at US law firm Lathrop GPM.
Regulators are likely to take an interest. Peter Hardy, a London-based partner at Reed Smith, told Bloomberg Law that a loss of this size would probably draw in US authorities, and noted that the UK was already working on new crypto rules. The FCA’s authorisation gateway for crypto firms opened on 30 September and closes on 28 February 2027, according to PwC. Directors of authorised firms will fall under the senior managers regime, which is likely to sharpen their interest in D&O cover.
Read next: War exclusions protect insurers as cyber spillover risk emerges
Binance is covering the loss itself. Its Secure Asset Fund for Users (SAFU), built from trading fees since 2018, held about US$1bn before the hack, according to the company’s disclosures. The rest is coming from a futures insurance fund and the corporate treasury.
“The SAFU Binance set up with USD1b, which looked like a big number at the time, doesn’t look so big now,” a prominent cyber underwriter told Insurance Business, speaking off the record.
About US$2.85bn of the stolen assets has been frozen or intercepted, mostly stablecoins whose issuers can block transfers, according to blockchain tracing of the theft. Bitcoin and ether have no issuer that can freeze them.
That does not mean the attackers can spend the rest freely. “Converting the stolen cryptocurrency into usable funds remains difficult for both state-sponsored actors and criminal groups,” the underwriter said. Laundering on this scale is slow and complex, the underwriter added, and often only part of the haul is ever cashed out.
Binance suspended withdrawals for almost two days and reopened them on 1 November. It says it has replaced about 95% of affected funds, while net outflows reached about US$4.7bn by 2 November.
Bitcoin fell more than 4% to just under US$76,000 after the theft and was trading at about US$77,600 on 3 November.
Read next: WTW just made a big move on crypto insurance – shrewd, or big risk?
The methods used against Binance would work just as well against a bank, a payments business or an MGA. Social engineering already drives most cyber losses: it accounted for 57% of incurred cyber claims in the first half of 2025, according to Resilience data cited in Insurance Business’s report on an employee-targeted MGA breach.
At renewal, underwriters are likely to ask how clients vet recruiters and new hires, who holds privileged keys and access tokens, and what internal AI tools are allowed to reach. For digital-asset clients, brokers should also check how much money sits in hot wallets, whether any self-insurance fund actually holds what it claims, and how war, state-backed and social engineering clauses are worded.
AI is making phishing and impersonation cheaper to run at scale, McMullin told Bloomberg Law, and it remains an open question whether policy wordings and underwriting will keep pace.
Read next: Lloyd’s new cyber mandate spurs “grey area” fears
