Binance said its Oct. 29, 2026, security breach followed a months-long campaign involving fake job interviews, tampered software, malicious programming tasks, compromised employee computers and an internal AI tool. Alleged North Korea-linked attackers obtained employee credentials and accessed the exchange's internal wallet-signing service, enabling transfers outside the normal withdrawal process that took about 20 minutes and were initially valued at approximately $6.3 billion before being revised to $6.34 billion. The stolen assets included 18,270 BTC, 233.46 million XRP, about 970,500 SOL, 44.2 million OP and 2,961.9 ETH. Binance said approximately $2.85 billion was frozen, customers did not bear the losses and about 98% of affected tokens were covered by company resources. Investigators later tracked stolen SOL through HitBTC and Privacy Cash, where a hacker-linked wallet deposited 8,567 SOL worth roughly $798,000 through split transfers. Onchain Lens said the activity appeared intended to obstruct tracking, while similar deposits into mixers and smaller transfers were detected across several decentralized wallets. Binance said its security team detected and prevented 57 suspected North Korea-linked cases in 2026.