Binance says it blocked 57 suspected North Korea-linked threats

cryptonews11-04 00:40

Binance says it blocked 57 suspected North Korea-linked cyber threats in 2026 and has replaced 98% of the tokens stolen in its $6.34 billion hack. Summary Binance detected recruitment scams, ...

Source Link

Disclaimer: Investing carries risk. This is not financial advice. The above content should not be regarded as an offer, recommendation, or solicitation on acquiring or disposing of any financial products, any associated discussions, comments, or posts by author or other users should not be considered as such either. It is solely for general information purpose only, which does not consider your own investment objectives, financial situations or needs. TTM assumes no responsibility or warranty for the accuracy and completeness of the information, investors should do their own research and may seek professional advice before investing.

Comments

We need your insight to fill this gap

Leave a comment

{"i18n":{"language":"en_US"},"isChannel":false,"data":{"share":"https://ttm.financial/m/news/2680331775?lang=en_US&edition=fundamental","thumbnail":"","is_english":true,"pubTime":"2026-11-04 00:40","share_image_url":"https://static.laohu8.com/e9f99090a1c2ed51c021029395664489","id":"2680331775","market":"sg","top_or_hot":-1,"title":"Binance says it blocked 57 suspected North Korea-linked threats","media":"cryptonews","content":"<div>\n<p>Binance says it blocked 57 suspected North Korea-linked cyber threats in 2026 and has replaced 98% of the tokens stolen in its $6.34 billion hack.\n\n\nSummary\n\n\n\nBinance detected recruitment scams, ...</p>\n\n<a href=\"https://crypto.news/binance-57-north-korea-threats-98-percent-replenished/\">Source Link</a>\n\n</div>\n","source":"crypto_news_highlight","html":"<!DOCTYPE html>\n<html>\n<head>\n<meta http-equiv=\"Content-Type\" content=\"text/html; charset=utf-8\" />\n<meta name=\"viewport\" content=\"width=device-width,initial-scale=1.0,minimum-scale=1.0,maximum-scale=1.0,user-scalable=no\"/>\n<meta name=\"format-detection\" content=\"telephone=no,email=no,address=no\" />\n<title>Binance says it blocked 57 suspected North Korea-linked threats</title>\n<style type=\"text/css\">\na,abbr,acronym,address,applet,article,aside,audio,b,big,blockquote,body,canvas,caption,center,cite,code,dd,del,details,dfn,div,dl,dt,\nem,embed,fieldset,figcaption,figure,footer,form,h1,h2,h3,h4,h5,h6,header,hgroup,html,i,iframe,img,ins,kbd,label,legend,li,mark,menu,nav,\nobject,ol,output,p,pre,q,ruby,s,samp,section,small,span,strike,strong,sub,summary,sup,table,tbody,td,tfoot,th,thead,time,tr,tt,u,ul,var,video{ font:inherit;margin:0;padding:0;vertical-align:baseline;border:0 }\nbody{ font-size:16px; line-height:1.5; color:#999; background:transparent; }\n.wrapper{ overflow:hidden;word-break:break-all;padding:10px; }\nh1,h2{ font-weight:normal; line-height:1.35; margin-bottom:.6em; }\nh3,h4,h5,h6{ line-height:1.35; margin-bottom:1em; }\nh1{ font-size:24px; }\nh2{ font-size:20px; }\nh3{ font-size:18px; }\nh4{ font-size:16px; }\nh5{ font-size:14px; }\nh6{ font-size:12px; }\np,ul,ol,blockquote,dl,table{ margin:1.2em 0; }\nul,ol{ margin-left:2em; }\nul{ list-style:disc; }\nol{ list-style:decimal; }\nli,li p{ margin:10px 0;}\nimg{ max-width:100%;display:block;margin:0 auto 1em; }\nblockquote{ color:#B5B2B1; border-left:3px solid #aaa; padding:1em; }\nstrong,b{font-weight:bold;}\nem,i{font-style:italic;}\ntable{ width:100%;border-collapse:collapse;border-spacing:1px;margin:1em 0;font-size:.9em; }\nth,td{ padding:5px;text-align:left;border:1px solid #aaa; }\nth{ font-weight:bold;background:#5d5d5d; }\n.symbol-link{font-weight:bold;}\n/* header{ border-bottom:1px solid #494756; } */\n.title{ margin:0 0 8px;line-height:1.3;color:#ddd; }\n.meta {color:#5e5c6d;font-size:13px;margin:0 0 .5em; }\na{text-decoration:none; color:#2a4b87;}\n.meta .head { display: inline-block; overflow: hidden}\n.head .h-thumb { width: 30px; height: 30px; margin: 0; padding: 0; border-radius: 50%; float: left;}\n.head .h-content { margin: 0; padding: 0 0 0 9px; float: left;}\n.head .h-name {font-size: 13px; color: #eee; margin: 0;}\n.head .h-time {font-size: 11px; color: #7E829C; margin: 0;line-height: 11px;}\n.small {font-size: 12.5px; display: inline-block; transform: scale(0.9); -webkit-transform: scale(0.9); transform-origin: left; -webkit-transform-origin: left;}\n.smaller {font-size: 12.5px; display: inline-block; transform: scale(0.8); -webkit-transform: scale(0.8); transform-origin: left; -webkit-transform-origin: left;}\n.bt-text {font-size: 12px;margin: 1.5em 0 0 0}\n.bt-text p {margin: 0}\n</style>\n</head>\n<body>\n<div class=\"wrapper\">\n<header>\n<h2 class=\"title\">\nBinance says it blocked 57 suspected North Korea-linked threats\n</h2>\n\n<h4 class=\"meta\">\n\n\n2026-11-04 00:40 GMT+8&nbsp;&nbsp;&nbsp;<a href=https://crypto.news/binance-57-north-korea-threats-98-percent-replenished/><strong>cryptonews</strong></a>\n\n\n</h4>\n\n</header>\n<article>\n<div>\n<p>Binance says it blocked 57 suspected North Korea-linked cyber threats in 2026 and has replaced 98% of the tokens stolen in its $6.34 billion hack.\n\n\nSummary\n\n\n\nBinance detected recruitment scams, ...</p>\n\n<a href=\"https://crypto.news/binance-57-north-korea-threats-98-percent-replenished/\">Source Link</a>\n\n</div>\n\n\n</article>\n</div>\n</body>\n</html>\n","isBrief":false,"type":0,"news_type":1,"symbol":"ETTY","symbol_name":"Amplify Ethereum 3% Monthly Option Income Etf","start_time":0,"source_url":"https://crypto.news/binance-57-north-korea-threats-98-percent-replenished/","article_id":"2680331775","we_media_id":null,"thumbnails":[],"rights":{"source":"crypto_news_highlight","url":"https://crypto.news/binance-57-north-korea-threats-98-percent-replenished/","rn_cache_url":null,"directOrigin":true},"url":"https://stock-news.laohu8.com/highlight/detail?id=2680331775","pubTimestamp":1793724044,"columns":[],"sourceInfo":{"source_id":"crypto_news_highlight","name":"Crypto News"},"weMediaInfo":null,"summary":"Binance says it blocked 57 suspected North Korea-linked cyber threats in 2026 and has replaced 98% of the tokens stolen in its $6.34 billion hack.Binance detected recruitment scams, malicious developer tools and fake video conferencing apps among suspected threats.Yi He acknowledged the severe cost of the attack that bypassed the exchange’s defenses.The exchange says it is still purchasing less liquid tokens to complete asset replenishment.US investigators have attributed the Oct. 29 theft to North Korea’s TraderTraitor activity.Binance co-founder and co-CEO Yi He outlined the attempted intrusions in a Nov. 3 post on X, sharing the exchange’s findings on the Oct. 29 security breach.Her account described repeated efforts to reach employees through recruitment, software downloads, and social engineering. The techniques included fraudulent job interviews, compromised software packages and browser extensions, and malicious programs presented as popular developer tools.Binance describes how","collect":0,"end_time":0,"defaultTopTitle":"crypto.news","property":[],"viewcount":null,"language":"en","relate_stocks":{"ETTY":"Amplify Ethereum 3% Monthly Option Income Etf","DFII":"FT Cboe Vest Bitcoin Strategy & Target Income ETF","BTF":"比特币&以太币期货ETF-CoinShares","BITW":"Bitwise 10 Crypto Index ETF","YETH":"Roundhill Ether Covered Call Strategy ETF","QETH":"以太坊ETF-Invesco Galaxy","ARKY":"ARK Active Autocallable Income ETF","CBTA":"Calamos Bitcoin 80 Series Structured Alt Protection ETF – April","BCCC":"Global X Bitcoin Covered Call ETF","ETU":"T-Rex 2X Long Ether Daily Target ETF","IBIT":"比特币ETF-iShares","STCE":"Schwab Crypto Thematic ETF","ETHU":"2倍以太币期货ETF-Volatility Shares","BITU":"2倍做多比特币期货ETF-Proshares","ETHV":"以太坊ETF-VanEck","BTCO":"比特币ETF-Invesco Galaxy","BITB":"比特币ETF-Bitwise","ETH":"低成本以太坊ETF-Grayscale","CBOO":"Calamos Bitcoin Structured Alt Protection ETF - October","CBTO":"Calamos Bitcoin 80 Series Structured Alt Protection ETF - October","BKCH":"AdvisorShares Sabretooth ETF","SETH":"1倍做空以太币期货ETF-Proshares","ETHW":"以太坊ETF-Bitwise","ETHA":"以太坊ETF-iShares","BETE":"等权重比特币&以太币期货ETF-ProShares","BFJL":"FT Vest Bitcoin Strategy Floor15 ETF - July","CRPT":"First Trust SkyBridge Crypto Industry and Digital Economy ETF","FETH":"以太币ETF-Fidelity","BETH":"比特币&以太币期货ETF-ProShares","CBXA":"Calamos Bitcoin 90 Series Structured Alt Protection ETF – April","DEFI":"比特币期货ETF-Hashdex","EETH":"以太币期货ETF-ProShares","BEGS":"RAREVIEW 2X BULL CRYPTOCURRENCY & PRECIOUS METALS ETF","CBXJ":"Calamos Bitcoin 90 Series Structured Alt Protection ETF - January","EZET":"以太坊ETF-Franklin","ETHE":"最大以太坊ETF-Grayscale","BAGY":"Amplify Bitcoin Max Income Covered Call ETF","ETHI":"Defiance Leveraged Long Income Ethereum ETF","ETQ":"T-Rex 2X Inverse Ether Daily Target ETF","SBIT":"2倍做空比特币期货ETF-Proshares","ETCO":"Grayscale Ethereum HIGH Income ETF","OOQB":"One+One Bitcoin and Ether ETF","BPI":"Grayscale Bitcoin Premium Income ETF","BFAP":"FT Vest Bitcoin Strategy Floor15 ETF - April","CBXY":"Calamos Bitcoin 90 Series Structured Alt Protection ETF - July","CBOA":"Calamos Bitcoin Structured Alt Protection ETF - April","TETH":"21Shares Ethereum ETF"},"translate_title":"币安表示已阻止 57 个疑似与朝鲜有关的威胁","themeId":null,"isJumpTheme":false,"ttsUrl":null,"symbols_score_info":{"ETHV":0.64,"ETTY":0.61,"BITB":0.6,"BITW":0.61,"YETH":0.64,"ETU":0.64,"CBXA":0.6,"TETH":0.6,"BAGY":0.6,"BTCO":0.6,"CRPT":0.9,"QETH":0.64,"CBTA":0.6,"CBTO":0.6,"DFII":0.6,"EZET":0.64,"BEGS":0.82,"EETH":0.64,"ETHA":0.64,"ETHE":0.64,"ETH":0.74,"ETHI":0.6,"BFJL":0.6,"BTF":0.9,"FETH":0.61,"BCCC":0.6,"ETCO":0.6,"BETE":0.9,"ETQ":0.6,"CBOA":0.6,"CBXJ":0.6,"BETH":0.9,"STCE":0.9,"ETHU":0.64,"BKCH":0.61,"ARKY":0.9,"BPI":0.6,"CBXY":0.6,"DEFI":0.6,"SBIT":0.6,"OOQB":0.61,"SETH":0.6,"BFAP":0.6,"IBIT":0.64,"ETHW":0.64,"CBOO":0.6,"BITU":0.6},"content_text":"Binance says it blocked 57 suspected North Korea-linked cyber threats in 2026 and has replaced 98% of the tokens stolen in its $6.34 billion hack.\n\n\nSummary\n\n\n\nBinance detected recruitment scams, malicious developer tools and fake video conferencing apps among suspected threats.\nYi He acknowledged the severe cost of the attack that bypassed the exchange’s defenses.\nThe exchange says it is still purchasing less liquid tokens to complete asset replenishment.\nUS investigators have attributed the Oct. 29 theft to North Korea’s TraderTraitor activity.\n\n\n\nBinance co-founder and co-CEO Yi He outlined the attempted intrusions in a Nov. 3 post on X, sharing the exchange’s findings on the Oct. 29 security breach.\nHer account described repeated efforts to reach employees through recruitment, software downloads, and social engineering. The techniques included fraudulent job interviews, compromised software packages and browser extensions, and malicious programs presented as popular developer tools.\nFake video conferencing applications were another route, alongside campaigns designed to steal credentials or install malware that gives attackers remote access to a computer.\n\n“We intercepted many of them, but the cost of failing to stop even one was severe—and this should never have happened,” Yi wrote.\n\nBinance describes how a fake interview reached an employee\nAccording to Binance’s initial findings, a software engineer was approached in September through a legitimate job-hunting platform by someone posing as a project director.\nA supposed human resources representative conducted a video interview and shared a social media profile containing personal photos and videos. A second interviewer, presented as the chief executive of a fictitious company, instructed the engineer to download an assignment onto a work computer.\nBinance said the assignment contained malicious code that ran during setup and escaped detection by the endpoint security tools in use.\nOn Oct. 20, the attacker used the compromised computer and an internal AI tool to reach two wallet engineers. Credentials obtained during that intrusion subsequently enabled access to wallet signing operations.\nThe exchange’s account describes several stages of intrusion, although Yi’s post does not break down how many of the 57 suspected cases involved recruitment lures.\nEarlier wallet authorization findings traced part of the theft to Binance 14, an Ethereum hot wallet. Blockaid identified 50 submitted EIP-7702 authorizations, one of which successfully delegated execution rights to a malicious contract.\nBinance reports 98% replenishment as token purchases continue\nIn its Nov. 3 report, Binance said 98% of the impacted token assets had been replenished and that it was buying the remaining, less liquid assets. The company said it had set aside more than the funds required to cover the loss.\nAs crypto.news previously reported, Binance reopened Bitcoin withdrawals on Nov. 1, when Richard Teng put replenishment at approximately 95%.\nThe exchange had identified BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC as fully backed. Its recovery notice said the outstanding tokens outside that group took longer to purchase in the quantities required.\nReplacement purchases have drawn on the Secure Asset Fund for Users, excess reserves from the Futures Insurance Fund and Binance’s corporate treasury, according to its earlier recovery disclosures.\nWithdrawal access has continued returning through individual assets and networks. On Nov. 3, Binance restored more withdrawals for 31 additional assets on Ethereum and 20 on Solana, following the reopening of five Ethereum stablecoins.\nUS investigators identify TraderTraitor activity\nThe FBI’s Oct. 31 cyber alert attributed the theft to North Korea and identified the activity as TraderTraitor.\nWorking with the US Secret Service and IRS Criminal Investigation, the bureau observed attackers converting stolen assets primarily into Ether. It said further laundering through decentralized finance and instant swap services was expected.\nThe agencies urged exchanges, blockchain analytics firms, DeFi services and infrastructure operators to block transactions involving the listed addresses or assets derived from them.\nNorth Korea denied involvement on Nov. 3. According to the Associated Press, Kim Yo Jong rejected the FBI’s accusation in a statement carried by state media.\nStolen funds enter CoinJoin transactions\nSeparate tracing work has documented the movement of stolen assets while Binance purchases replacements.\nElliptic identified approximately 28 BTC, worth $2.2 million, entering 18 CoinJoin transactions between Nov. 1 and early Nov. 2. The Bitcoin came from converted stolen assets, while the 18,270 BTC taken directly from Binance remained in 19 addresses at that assessment.\nThe firm’s investigation covered roughly 12,000 wallets, 11 blockchains, and more than 40,000 transactions. Theft-linked addresses still held an estimated $3.24 billion, mainly in Ethereum and Bitcoin.\n\n\n\n\n\n                Read more:\n            \n\n                Bhutan’s Gelephu Central Bank cleared to hold crypto in reserves","kind":"highlight","is_publish_news":true,"is_publish_highlight":false,"is_publish_live":false,"is_publish_wemedia":false,"editions":null,"column":"","sentiment":"0","news_tag":"","news_rank":0,"isVideo":false,"video":null,"symbols":[],"gpt_button":0,"need_auth":false,"need_login_tip":false,"code":"91000000","status":"200"},"commentList":[],"isCommentEnd":true,"newsSizeData":{"likeSize":0,"commentSize":0,"repostSize":0,"favoriteSize":0,"likeStatus":false,"favoriteStatus":false},"APP":{"userAgent":"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)","isDev":false,"isTTM":true,"isLaohu8Offline":false,"tenantId":"TBGLOBAL","deviceId":"web-server-community-laohu8-v3","version":"4.52.1","shortVersion":"4.52.1","platform":"web","vendor":"web","appName":"ttm","isIOS":false,"isAndroid":false,"isTiger":false,"isTHS":false,"isWeiXin":false,"isWeiXinMini":false,"isWeiBo":false,"isQQ":false,"isBaiduSwan":false,"isBaiduBox":false,"isDingTalk":false,"isToutiao":false,"isOnePlus":false,"isHuaWei":false,"isXiaomi":false,"isXiaomiWebView":false,"isOppo":false,"isVivo":false,"isSamsung":false,"isMobile":false},"href":"/m/news/2680331775","isCrawlerRequest":true}