$6.3bn: Binance’s estimate of the loss, a record for a crypto theft
$2.85bn: frozen or intercepted so far
About $1bn: Binance’s own user protection fund before the hack
95%: share of affected funds Binance says it has replaced
57: North Korea-linked attacks Binance says it blocked earlier in 2026
In September, a Binance software engineer took a call about a new job. Six weeks later, code he downloaded for the take-home test had helped attackers walk off with about $6.3bn, the largest crypto theft on record.
Binance set out the sequence in an incident report on Tuesday. The FBI has attributed the attack to TraderTraitor, a North Korean state-backed hacking group. North Korea denies any role. The exchange also had no cyber insurance to claim on, Bloomberg Law reported, citing a person familiar with the matter.
The first break-in came in June. An employee setting up an AI coding assistant downloaded a tampered installer, which showed the attackers who at Binance worked on its wallet systems.
In September, someone claiming to be a project director at a company that did not exist contacted a second engineer on a legitimate job site. A fake HR representative then interviewed him on video and shared a social media profile full of personal photos, Binance’s chief security officer Jimmy Su told reporters. The coding assignment he downloaded contained malicious code.
On October 20, the attackers used his laptop and an internal Binance AI tool to take over the computers of two engineers on the wallet team. Binance has not said what the tool does or how it was misused. On October 29, they used stolen credentials to launch a container and run a script that moved funds out of Binance’s hot wallets, the internet-connected wallets that handle customer withdrawals.
“This should not have happened,” Binance said in an apology to users. Co-chief executive Richard Teng said on X that the company published the full report so other firms could learn from it.
Read next: The threat landscape that should be keeping US cyber underwriters up at night
Fake recruitment is one of North Korea’s best-documented methods. Palo Alto Networks tracks it as “Contagious Interview.” The country also runs the reverse scheme, placing its own operatives in remote IT jobs at Western companies.
In 2022, a fake job offer to an engineer at Axie Infinity preceded a theft of about $600m. In February 2025, hackers took about $1.5bn from Bybit, the previous record, and the FBI blamed TraderTraitor for that attack as well.
The attacks are getting bigger. TRM Labs estimates that North Korea-linked groups took about 76% of all crypto hack value in the first four months of 2026. Binance says it blocked 57 suspected North Korea-linked attempts this year before this one succeeded.
Binance holds directors and officers cover for executives who may face investigations or lawsuits over the hack. According to Bloomberg Law, it has not been able to buy cyber insurance, a position it shares with many crypto firms. Binance has not commented on its cover.
The policies it might have bought often exclude this kind of loss. Standard crime forms were written for cash and securities, and most cyber wordings exclude the loss or transfer of funds unless digital-asset cover is added. Christopher Keegan of Brown & Brown said that specie policies can protect coins held offline in cold storage, but typically do not cover tokens stolen from hot wallets in a hack.
The FBI’s attribution adds another problem. Once a government names a state actor, war and state-backed attack exclusions come into play. Lloyd’s Market Bulletin Y5381 has required standalone cyber policies to carry such exclusions since March 2023, though it is unclear whether a theft from a private exchange meets the bulletin’s threshold. “State sponsorship does not automatically eliminate coverage,” said Alana McMullin, a policyholder-side partner at Lathrop GPM.
Peter Hardy, a partner at Reed Smith, told Bloomberg Law that a loss this size is likely to draw in US regulators.
Read next: Water utility attacks revive cyber insurance’s war exclusion debate
Binance is covering the loss itself. Its Secure Asset Fund for Users, built from trading fees since 2018, held about $1bn before the hack, according to the company’s disclosures. The rest is coming from a futures insurance fund and the corporate treasury.
“The SAFU Binance set up with USD1b which looked like a big number at the time doesn’t look so big now, “ a prominent cyber underwriter told Insurance Business in an off the record discussion.
About $2.85bn of the stolen assets has been frozen or intercepted, mostly stablecoins whose issuers can block transfers, according to blockchain tracing of the theft. Bitcoin and ether have no issuer to freeze them.
“Converting the stolen cryptocurrency into usable funds remains difficult for both state-sponsored actors and criminal groups,” said the underwriter we spoke to. “Forcing attackers to rely on complex, time-consuming laundering methods that often result in only a portion of the funds being successfully cashed out.”
Binance paused withdrawals for almost two days and reopened them on Sunday. It says it has replaced about 95% of affected funds, while net outflows reached about $4.7bn by Monday. Binance.US, a separate company, says it was not affected.
Bitcoin fell more than 4% to near $76,000 after the theft and traded around $77,600 on Tuesday.
Read next: Antares backs new affirmative cyber war cover for US critical infrastructure operators
The methods used on Binance would work against a bank, a payments firm or an MGA. Social engineering already drives most cyber losses: it accounted for 57% of incurred cyber claims in the first half of 2025, according to Resilience data cited in Insurance Business’s report on an employee-targeted MGA breach.
At renewal, underwriters are likely to ask how clients vet recruiters and new hires, who holds privileged keys and access tokens, and what internal AI tools are allowed to reach. For digital-asset clients, brokers should also check how much money sits in hot wallets, whether any self-insurance fund holds what it claims, and how war, state-backed and social engineering clauses are worded.
AI makes phishing and impersonation easier to run at scale, and that it is an open question whether policy language and underwriting will keep up.
Read next: The Binance heist took 30 minutes. The groundwork took days
