Binance says it blocked 57 suspected North Korea-linked threats

Binance says it blocked 57 suspected North Korea-linked cyber threats in 2026 and has replaced 98% of the tokens stolen in its $6.34 billion hack. Summary Binance detected recruitment scams, malicious developer tools and fake video conferencing apps among suspected threats. Yi He acknowledged the severe cost of the attack that bypassed the exchange’s defenses. The exchange says it is still purchasing less liquid tokens to complete asset replenishment. US investigators have attributed the Oct. 29 theft to North Korea’s TraderTraitor activity. Binance co-founder and co-CEO Yi He outlined the attempted intrusions in a Nov. 3 post on X, sharing the exchange’s findings on the Oct. 29 security breach. Her account described repeated efforts to reach employees through recruitment, software downloads, and social engineering. The techniques included fraudulent job interviews, compromised software packages and browser extensions, and malicious programs presented as popular developer tools. Fake video conferencing applications were another route, alongside campaigns designed to steal credentials or install malware that gives attackers remote access to a computer. “We intercepted many of them, ...