It started with a fake job interview and ended, four hours later, with $6.34 billion gone — the largest cryptocurrency theft ever recorded. On 29 October, attackers drained the hot wallets of Binance, the world’s biggest crypto exchange, in a campaign months in the making. A week later, roughly half the money is frozen, about $3.1 billion is still sitting in the thieves’ wallets, and the market is still reeling: Bitcoin and Ether fell to two-month lows over the weekend, as the heist collided with a US election result that has traders fearing tougher crypto rules.
A months-long campaign, not a smash and grab
Binance’s own account of the attack, published on 3 November, reads less like a burglary than a long con. In September, someone posing as a project director contacted a Binance software engineer through a job-hunting platform with a fake interview — and planted tampered software on the engineer’s computer. On 20 October, the attackers used that foothold, plus one of Binance’s internal AI tools, to take control of the work computers of two engineers on the wallet team, one of whom had permission to deploy software.
Nine days later, at around 20:05 UTC on 29 October, they used that permission to reach the service that signs transactions and began draining the exchange’s hot wallets — the wallets kept online to process everyday withdrawals — over nearly four hours. They also abused a feature of Ethereum itself, the EIP-7702 mechanism, to delegate partial control of a hot wallet to a contract they controlled, which swept funds out from behind the normal withdrawal process. Binance’s co-chief executive put it plainly: “This was not a single mistake or a single breach. It was a campaign built over many months.” The exchange says it stopped 57 other suspected North Korean attacks this year alone.
Who the FBI blames — and where the money is
On 31 October, the FBI attributed the theft to TraderTraitor, the North Korean hacking operation it has tracked for years, and published 628 wallet addresses connected to the theft — 608 on Ethereum, 19 on Bitcoin and one on Solana — asking crypto firms to block them. North Korea has denied involvement.
The recovery picture, a week on, is genuinely unusual. About $2.85 billion — 44% of the haul — has been frozen or seized, mostly stablecoins intercepted with the help of Tether and Circle. But blockchain-analytics firm Elliptic reported on 6 November that roughly $3.11 billion is still sitting in attacker-controlled addresses, mostly unmoved Ether and Bitcoin. Some 18,270 BTC, worth about $1.5 billion at the time of the theft, has not moved at all, and the nine largest Ethereum addresses holding 89% of the attackers’ ETH have been still since 30 October. Elliptic puts the laundering effort so far at more than 20,000 wallets, 16 blockchains, at least 36 services and 65,000 transactions.
The scale dwarfs everything before it: the 2022 Ronin bridge hack took $624 million; the February 2025 Bybit hack, also attributed to North Korea, took about $1.5 billion. This one is more than four times that.
Binance customers are covered — this time
For Binance users, the immediate damage was contained. The exchange paused withdrawals for about two days, reopened them on 1 November, and says it has replenished 98% of the affected tokens from its own reserves and insurance funds, setting aside more than $6.34 billion from its SAFU (Secure Asset Fund for Users) reserve and the corporate treasury. Binance has promised customers will not absorb the loss.
That is the good news — and it is also the uncomfortable part. The safety net held because Binance is enormous and could afford to absorb a $6.3 billion hit. A smaller exchange could not have. The heist is a reminder that when you keep coins on any exchange, you are trusting that exchange’s security, its balance sheet and its insurance — not just its brand name.
The market’s double hit
The heist alone might have been absorbed. It landed in the same week as a political shock: in the US midterm elections on 3 November, Democrats won control of both the House and the Senate, and traders are now pricing in a harder road for crypto-friendly legislation. The industry-backed CLARITY Act, which would set federal rules for crypto markets, already stalled in the Senate in September; a new Congress convening in January 2027 is expected to be less sympathetic.
The result, in late Sunday trading on 8–9 November: Bitcoin fell more than 2% to $73,708, its lowest since August, and Ether dropped about 5% to $2,223, also its weakest since August. Early on Monday, Bitcoin briefly touched $73,510 before recovering above $75,000, while Ether dipped as low as $2,060. CoinGlass data showed about $856 million in leveraged positions liquidated in 24 hours, and the Fear & Greed Index sits at 29 — firmly in “fear”. US spot Bitcoin funds recorded about $412 million in net outflows on Friday alone, capping a week in which Bitcoin ETFs shed $1.28 billion and Ethereum funds lost $365 million for a sixth straight week.
What this means for ordinary holders
Exchange risk is real, even at the biggest names. The largest exchange in the world, with the deepest security budget in the industry, lost $6.3 billion to a fake job interview. If you hold meaningful amounts of crypto on any exchange, consider what you actually need there for trading — and what belongs in a wallet you control.
Freezing worked better than anyone expected — and that matters. The fact that 44% of the haul was frozen within days shows the industry’s emergency plumbing — stablecoin issuers, exchanges, law enforcement — can now move fast. But it also shows the limits: frozen stablecoins can be stopped; Bitcoin and Ether sitting in attacker wallets cannot be clawed back by anyone.
The politics now matter as much as the code. The market’s problem this week is not just a hack. It is a hack plus a Congress that may write tougher rules, plus a Federal Reserve that may raise rates again in December. Tuesday’s US inflation report is the next test: a hot reading would near-certainly lock in a December hike and extend the downtrend.
What to watch next
Tuesday’s US CPI, 8:30 a.m. Eastern. The last inflation reading before the Fed’s 8–9 December meeting — and the number that decides whether the December hike happens.
Whether $75,000 holds for Bitcoin. Analyst Michaël van de Poppe has called it the key support; a clean break opens the way toward the low $70,000s.
The stolen funds. Elliptic’s $3.11 billion figure will move as laundering continues — a sudden burst of movement from the nine big ETH addresses would be the signal the thieves are cashing out.
The FBI’s 628 addresses. How widely exchanges and payment firms adopt the blocklist will show whether the industry can police itself when the next attack comes.
Congress in January. Whether the new Democratic majorities revive, rewrite or bury the CLARITY Act will set the regulatory weather for 2027.
One fake interview, four hours, $6 billion gone — and a market that now has to price in both the hack and the politics that followed it. The heist itself may be the week’s biggest story, but the question it leaves behind is bigger: if the world’s largest exchange can be robbed this way, what does “safe” actually mean in crypto?
This post is for information only and is not financial advice. Figures are as reported by Binance, the FBI, Elliptic, Chainalysis, Reuters, CoinDesk, the Business Times and other outlets on 3–9 November 2026; the attribution to North Korea is the FBI’s finding, which North Korea denies. Cryptocurrency markets are volatile — do your own research before making investment decisions.
