Binance says its security team detected and prevented 57 suspected North Korea-linked cyber threat cases during 2026. The exchange disclosed the figure in its November 3 initial report on the October 29 wallet breach, which it estimates affected $6.34 billion in digital assets.
The tally is Binance's own assessment. It hasn't published a case-by-case breakdown or dates for all 57 incidents, and the suspected links to North Korea aren't independent findings about each attempt. The number shows what the exchange says it stopped while explaining how attackers still reached its wallet infrastructure.
Binance describes a persistent campaign
The company's report puts the number alongside its account of an earlier compromise involving a wallet-infrastructure engineer:
"Throughout 2026, Binance's security team detected and prevented 57 suspected North Korea-linked cyber threat cases."
It lists several techniques behind those attempts: fake job interviews, malicious downloads posing as popular developer tools, compromised software packages and browser extensions, fake video-conferencing apps, and efforts to steal credentials or install remote-access malware.
Those tactics target the people and software inside a business. An attacker doesn't have to start by breaking a cryptocurrency's underlying network if an employee's computer can provide a route into systems that approve transfers.
The successful intrusion developed over months, according to the exchange's timeline. In June, a wallet DevOps engineer downloaded a tampered Homebrew installation while trying to install an AI coding tool. Security staff detected an anomaly, replaced the device and rotated credentials. Binance says the engineer's role and connections to colleagues had nevertheless been exposed.
A job interview became another way inside
As Apex previously reported, another engineer was approached through a legitimate job-hunting platform in September. The supposed employer arranged interviews with people posing as company representatives and then supplied a coding assignment containing malicious software.
The engineer downloaded it onto a work computer. The attackers later used compromised internal AI tooling to reach additional wallet engineers and obtain credentials that helped them access wallet infrastructure. On October 29, unauthorized transactions were initiated outside Binance's normal withdrawal process.
Pausing withdrawals couldn't stop every transfer. Binance said malicious on-chain permissions operated independently of its withdrawal infrastructure, so it needed separate transactions to revoke those authorizations.
The FBI attributed the theft to North Korea. Pyongyang denied responsibility, as previously reported by Apex in its coverage of the competing statements.
The 57 suspected cases and the October 29 breach describe different outcomes. Without a full account of attempted intrusions, the prevention figure alone doesn't establish how consistently the exchange's defenses caught this campaign or other attackers.
Questions remain about the controls that failed
Fresh reporting by TechCrunch on November 3 highlighted how familiar these methods were to security researchers. North Korean hackers have long used recruitment approaches and false identities to persuade technology workers to give them access.
The outlet asked Binance how it prevents unauthorized or malicious code from running on employee laptops and whether outside firms had audited its network before the theft. A spokesperson referred it to the public statement and declined to answer those questions on the record.
Binance says it has closed the identified entry points, rebuilt or replaced systems along the attack path, tightened device controls and strengthened wallet-service protections. It also says it expanded AI-based detection of unusual behavior.
Apex's earlier coverage also detailed Binance's estimate of roughly $2.85 billion in assets frozen or intercepted, subject to reconciliation and changes in market prices. That figure should not be read as finalized recoveries or as proof that the stolen assets had all been returned.
Binance has said it will absorb the financial impact rather than pass it to users. Its investigation, however, remains preliminary, with outside security firms being engaged to review the incident:
"The investigation remains ongoing and our findings will be subject to further independent review."