theft

Binance's Chief Security Officer Jimmy Su stated in a July interview that fake job interviews could lure employees into running malicious code on company devices, leading to device control, credential theft, and infiltration of internal networks.In September, a Binance software engineer downloaded a malicious programming assignment to their work computer during a fake interview; Binance's preliminary investigation indicated that this incident was part of a multi-stage attack in the October theft case. Jimmy Su also pointed out that attackers might exploit seemingly normal technical assessment steps to bypass antivirus tools. Binance's subsequent investigation revealed that the installer for the malicious assignment evaded endpoint security tools through obfuscation and other evasion techniques.Binance stated that it has intercepted 57 suspected cyber threats related to North Korea so far this year, approximately one every five days. After the October attack, Binance announced that it has strengthened device and access controls, rebuilt affected wallet systems and internal AI tools, and increased investments in endpoint protection and development environment security.

On November 11, the Selangor police in Malaysia publicly destroyed 186 seized Bitcoin mining machines, with the state police chief, Shafie, personally driving a bulldozer to crush the equipment. This destruction operation involved 7,445 pieces of evidence seized between 2021 and 2026, with a total value of approximately 1.19 million Malaysian Ringgit, which has been approved by the court.In addition, the Perak police recently collaborated with the national energy company to raid a residential house suspected of stealing electricity for mining, seizing another 48 Bitcoin mining machines. An investigation is currently underway based on relevant criminal and electricity regulations.

The Scottish High Court sentenced 29-year-old Robert Barr to 8 years in prison for allegedly planning to steal cryptocurrency while in prison, with the amount involved reaching up to £2 million (approximately $2.7 million). Co-defendants Sean Favier (26) and Iain Doyle (37) both admitted to participating in serious organized crime, receiving sentences of 4 years and 5 years, respectively. Judge Lord Cubie stated that this case combines 21st-century computer technology with old-fashioned burglary.According to court disclosures, Barr's plan was to have Favier and Doyle enter a residence near Midlothian, Edinburgh, and force the victim to install remote control software AnyDesk on their computer, allowing Barr, who was serving a 21-month fraud sentence at HMP Edinburgh at the time, to remotely control the computer and transfer cryptocurrency into a wallet under his control. Around 11:30 PM on April 17, 2024, the two arrived at the residence, but the homeowner couple discovered them through the doorbell camera and refused to open the door, causing the plan to fail.Investigators recovered months of preparations from Barr's phone, which was seized in June 2024, including identifying the victim, collecting photos of the house, and conducting reconnaissance. The phone messages explicitly mentioned threats or violence. The victim is a co-founder of a cryptocurrency startup, whose accomplices had previously stolen a cryptocurrency wallet in January 2024 but were unable to access the funds due to a lack of a PIN code. Prosecutors described Barr as a "seasoned cybercriminal." The judge will consider issuing a serious crime prevention order against him on November 17, and Barr is currently detained due to potential extradition matters. According to a report by Chainalysis, the amount stolen in such "ransom attacks" exceeded $30 million in the first half of 2026.

According to Lookonchain monitoring, the hacker address that stole over 26 million dollars in assets from TLBL used approximately 3.4 million DAI to purchase about 1,650 ETH.

According to Cointelegraph, the Bitcoin Lightning Network wallet platform LNbits urgently released version 1.7.0 after experiencing a wave of attacks that led to stolen funds, urging users to update immediately. LNbits warned that the vulnerability affects all earlier versions, and simply upgrading will not protect users whose credentials have already been leaked. It is recommended to reset wallet keys, change relevant credentials, and migrate servers if an intrusion is suspected.LNbits founder Ben Arc stated that the team is working hard to respond after users and the team suffered losses. Some users reported that attackers created new accounts using their LNbits instances, stealing approximately 0.023 Bitcoin.

According to The Defiant, security company PeckShield discovered a Hyperliquid account holding long positions in ETH that may be related to a theft incident involving the Web3 social protocol UXLINK through an intermediary wallet. Subsequent dashboard snapshots show that the position is approximately 20,919 ETH, valued at around 44 million dollars, with an unrealized loss of about 652,000 dollars, an average entry price of 2,134.45 dollars, using 15x full leverage, and an estimated liquidation price of 1,630.63 dollars.The report states that the connection is based on an intermediary address transferring 11 million USDC to the trading account, and this intermediary address had previously interacted with an address marked as the UXLINK attacker; this indirect link alone cannot prove that the trader controls the attacker’s wallet. Previously, related addresses had begun to gradually close out long positions in ETH, SOL, and XRP, with the original position's total value being approximately 148 million dollars.

b14g released a security incident review report on October 31, 2026, which pointed out that attackers exploited a compatibility flaw between its staking contract and the native staking contract of the Core network. Through a single transaction, they initiated 99 zero-amount (0 CORE) withdrawal requests to 91 staking orders, resulting in approximately 97.05 million CORE being stolen. This attack did not involve private key leakage, nor did the attackers modify or deploy new b14g contract code.BTC staked through b14g was unaffected and remains locked on the Bitcoin chain. In terms of fund recovery, approximately 68.15 million CORE (about 70.2% of the total stolen amount) was recovered on November 2 through a hard fork of Core, and another approximately 12 million CORE has reportedly been frozen by trading platforms. Regarding user compensation, b14g plans to return the recovered CORE to affected orders in proportion to their original balances within the next 5 to 7 days, while the remaining losses will be repaid through 50% of future Core staking business income, with affected users able to receive payments weekly.

According to the security organization SEAL, the North Korean-linked hacker group TraderTraitor, suspected of attacking Binance, may have been lurking in its environment for about 8 weeks before the theft occurred on October 29.SEAL stated that the timeline and details described in Binance's preliminary report align with the group's pattern of using fake companies and recruitment processes to carry out attacks. The security organization believes that the attackers' period of lurking in the target environment provided an opportunity for the enterprise to discover the intrusion.

North Korea establishes hacker teams through state-supported talent training programs, selecting about 150 to 200 students from middle schools each year to receive computer education, with some individuals eventually entering military cyber units.Outstanding hackers can receive benefits such as housing in Pyongyang and foreign currency rewards, while relevant military cyber units can receive up to 30% of the profits from attacks.

After Bitquery tracked a case of iPhone wallet theft, it found that the associated collection address transferred at least approximately 4.06 million USDT from 365 TRON wallets.

According to the Nikkei, data from Chainalysis shows that in reported cryptocurrency theft incidents in 2026, 89% involved North Korean hackers, compared to 15% in 2021.The report states that North Korean hackers are increasingly using generative AI to create fake documents and impersonate technicians. The South Korean government estimates that more than 8,000 personnel are employed by North Korean authorities for this purpose.

According to a report by the Korean News Agency, an official from South Korea's Ministry of Unification stated that the government has not yet begun discussions on whether to impose sanctions due to North Korea's alleged theft of cryptocurrency from Binance. Currently, the South Korean government has not fully grasped the specifics of this hacking incident, and discussions on related responses have not yet been initiated.Previously, the Federal Bureau of Investigation (FBI) identified North Korea as responsible for the theft of over $6 billion in cryptocurrency from Binance, the world's largest cryptocurrency exchange platform. North Korean leader Kim Jong-un's sister, Kim Yo-jong, denied the allegations earlier this week, calling them a "serious political provocation" against North Korea. An official from the Ministry of Unification stated that further information sharing and discussions are still needed within the government.

On November 4, the French banking group Crédit Mutuel Arkéa announced details of a previously disclosed theft of funds revealed by ZachXBT. The bank stated that the attackers gained access through a platform of an unnamed third-party service provider, and then used the bank's own accounts to transfer funds to other financial institutions, with the related funds potentially being exchanged for cryptocurrency through specialized platforms.The bank denied that the attack entry point was located in its online bank Fortuneo and stated that customer assets were unaffected. Regarding the previously reported stolen amount of approximately 118 million euros (133 million dollars), the bank did not confirm the specific figure but acknowledged its magnitude, with some funds already frozen and the final loss still being assessed.

The open-source Bitcoin payment processing tool BTCPay Server has received multiple reports of unauthorized fund theft from its Bitcoin and Litecoin hot wallets on the platform. The project team released an investigation update confirming that the attack targeted servers running BTCPay Server version 2.4.1 or earlier. The attackers exploited a vulnerability that was fixed in version 2.4.2 on August 7, gaining administrative access to the servers through various methods and draining the hot wallet funds.BTCPay Server founder Nicolas Dorier confirmed that only servers running versions prior to 2.4.2, particularly version 2.4.1, were affected; users running the latest version 2.4.7 have not reported any credible losses. Some affected service providers, including LunaNode, have automatically shut down at-risk older instances. The official recommendation for users still using version 2.4.1 or earlier is to immediately transfer any remaining funds in old hot wallets to a new wallet created with a completely new mnemonic, take the old server offline while retaining relevant logs, and then install the latest version on a new virtual machine and connect the new wallet, ensuring not to restore the old server entirely to the new machine.Simply updating the software version is not enough to eliminate the risk, as attackers may have gained persistent access to the old server. Funds stored outside the server, such as those in hardware wallets, were not affected by this incident. The vulnerability is related to a flaw fixed in August of this year, when attackers had manipulated nodes by obtaining LND administrative credentials. As of now, this vulnerability has not been assigned a CVE number and is not listed in CISA's known exploited vulnerabilities catalog.

After Binance suffered a major hacking attack, some strangers sent tiny amounts of Bitcoin to the hacker-controlled wallets via the blockchain, accompanied by messages that included begging, promotions, and money laundering suggestions. These transaction amounts are usually less than 1 dollar, and the senders utilized Bitcoin's OP_RETURN feature to write text information on the chain.One sender has repeatedly sent "Help me bro" to all 19 wallets held by the hacker since last Friday. The sender paid about 1000 satoshis (approximately 78 cents) for each wallet in each round, spending a total of about 46 dollars after three rounds, including fees, and has not received a response so far.Others suggested that the hacker go to THORChain via a link for asset swapping and stated not to return the funds to Binance founder CZ. A person claiming to be a Turkish crypto influencer promoted their own token and requested donations from the hacker to support their ecosystem. Another person left a message saying "Happy Hacklloween Satoshis for treats PLS." The hacker has not responded, and the stolen funds have not moved since last Thursday.

According to The Washington Post, former FBI agent Patrick Yaroch is scheduled to appear in front of Judge Patricia Tolliver Giles at the U.S. District Court for the Eastern District of Virginia to plead guilty for allegedly stealing approximately $1 million in digital assets from cryptocurrency wallets associated with hostile nations. Prosecutors stated that he had used ChatGPT to plan his move to Portugal.

Binance co-founder CZ stated that such a large-scale hacking attack indicates a serious security failure. No platform can guarantee absolute security, but this cannot be an excuse.CZ mentioned that the public explanation simplified this attack, which seemed to have lasted for months or even years, targeting hundreds of employees and systems, with only a few specific targets ultimately breached. He believes that sharing details can help the entire industry learn lessons. As a shareholder, he hopes Binance will transparently disclose issues, take responsibility, listen to criticism, and make substantial improvements.

The founder of the blockchain security company Slow Mist, Yu Xian, posted on the X platform stating that many people, after watching the disclosure of the theft process by Binance, believe that the involved engineer made basic mistakes and had excessive permissions.Yu Xian indicated that such incidents belong to Advanced Persistent Threats (APT), involving human exploitation, intelligence reconnaissance, evasion of malicious code, trust chain exploitation, targeted lateral poisoning, cloud environment penetration, risk control bypass, and 0-day vulnerabilities, among other aspects. One cannot only focus on the initial social engineering phase.