Binance has published an incident report on the theft of about $6.3 billion on October 29, which TRM Labs calls the largest cryptocurrency theft on record. According to The Register, the FBI attributed it over the weekend to TraderTraitor, a North Korean operation linked to the Lazarus Group; TRM and Chainalysis had already named the same unit.

Binance describes a months-long intrusion, not a single phishing email. In June an engineer downloaded a malicious Homebrew installer; staff caught it and replaced the device. In September a second engineer was approached on a job-hunting platform and taken through fake interviews, the last with someone posing as a CEO who asked them to download a code "assignment" that carried malware. On October 20 the attackers used that machine and an internal AI tool to reach two wallet engineers' computers, and on October 29 they used a stolen container-deployment token to launch the theft.

TRM told WIRED the wallets on at least ten blockchains were drained in about 20 minutes, after test runs on smaller wallets. Binance says it will cover all losses and has rebuilt the wallet system and the AI tool.

When Binance reopened withdrawals on Sunday, November 1, it processed $4.65 billion out and $1.01 billion in, for $3.64 billion in net outflows (about 2.1% of its $171 billion in assets), CNBC reports. Bitcoin slid about 4% on Friday, less than the 8.3% average first-day drop after past exchange hacks, per Anchorage Digital data cited by CNBC.