TLDR
- Security Alliance (SEAL) says hackers had about eight weeks of access between September and October, while Binance dates the wider campaign to June.
- Circle froze 823 million USDC, and Sentora says DeFi lending saw a smaller withdrawal wave than after the Kelp DAO exploit.
- Elliptic traced about $124 million in Bitcoin converted from other stolen assets.
- Binance says it has replaced about 98% of affected assets.
- Insurers are asking more questions, but no crypto policy covers a loss this large.
The $6.3 billion theft from Binance on Oct. 29 is the largest crypto heist on record. In the days since, security groups, investigators and insurers have each released new details. Together, they show how the attack unfolded and what has happened to the money.
🚨 NORTH KOREA-LINKED HACKERS MAY HAVE INFILTRATED BINANCE 8 WEEKS BEFORE THE $6.3 BILLION HACK.
According to cybersecurity group SEAL, attackers may have gained access to Binance’s internal systems as early as September.
The attack reportedly involved fake job interviews,…
— Nehal (@nehalzzzz1) November 6, 2026
Security Alliance, a nonprofit cybersecurity group known as SEAL, said North Korea-linked hackers compromised a Binance software engineer’s device in September. The group says the hackers used a fake recruitment scheme to get in. SEAL estimates the intrusion window at about eight weeks before the exploit.
How the Attack Unfolded
Binance gave a longer timeline. A spokesperson said the first device compromises happened in June and September. The attackers did not gain the access needed to reach wallet operations until Oct. 20.
SEAL said its eight-week figure covers only the September-to-October period. It does not cover the start of the wider campaign that Binance described.
The June breach began when a different employee downloaded a tampered Homebrew installation. The employee was trying to install an AI coding tool at the time. Binance detected the incident, replaced the device and rotated related credentials. By then, the attackers had already collected information about staff working on wallet infrastructure.
On Oct. 20, the attackers used the engineer’s compromised computer and an internal AI tool. With them, they took control of two wallet infrastructure engineers’ devices. They then found a deployment permission token, which they used in the Oct. 29 exploit.
SEAL named at least four front companies tied to the fake recruitment campaigns in 2026. They are citalab.net, citalab.com, bitfit.io and oddium.io. The group said similar multi-stage patterns appeared in other thefts.
SEAL estimates the attackers had about six weeks of access before the $388 million Bitget hack. It also estimates six weeks of access to LayerZero before the flaw behind the $293 million Kelp DAO exploit. It put the window at about three weeks before the $24 million AFX exploit.
The FBI attributed the attack to North Korea’s TraderTraitor group. Kim Yo Jong, sister of North Korean leader Kim Jong Un, dismissed the accusation.
Frozen Funds and Market Reaction
Sentora, a DeFi analytics firm, described the response as the largest coordinated on-chain asset freeze in DeFi history. Circle blocked 823 million USDC in one wallet before the attacker could move it. Ripple froze about $40 million in RLUSD. World Liberty Financial froze $27 million in USD1 and 48 million WLFI tokens.
Bitcoin and Ether have no issuer that can block funds this way. Sentora found 18,270 BTC and more than 420,000 ETH among the attacker’s holdings after containment.
DeFi lending markets lost $1.59 billion in net outflows in one day, about 3% of total value locked. Around 60% of that money returned within three days. Sentora found no bad debt in the markets it assessed.
The Kelp DAO exploit in April led to $10.9 billion in withdrawals over five days, about 21% of lending value locked. None of it returned during that window. Sentora said the difference came from where the damaged assets sat. Binance’s loss stayed at the exchange, while Kelp’s asset served as collateral across lending markets.
Elliptic said about 1,650 BTC, worth $124 million, had been converted from other stolen assets as of Nov. 6. That was almost double the previous day’s figure. Most of the growth came from XRP swapped through THORChain.
The original 18,270 BTC remained untouched across 19 addresses. Elliptic counted more than 20,000 wallets and 65,000 transactions across 16 blockchains. About $3.11 billion remained in theft-linked addresses.
Binance said on Nov. 4 that it had replaced about 98% of the affected assets with company resources. The remaining 2% involves less liquid tokens that it is buying through market and over-the-counter channels. On Nov. 5, it asked Arbitrum’s DAO to approve the return of 8,425.997 ETH and 74,559,805.2 ARB, a process it expects to take about 49 days.
Reuters reported on Friday that insurers are questioning crypto clients more closely. Marsh’s Jacqueline Quintal does not expect material changes in pricing, coverage or capacity. Insurers may ask clients to fix vulnerabilities, and many policies exclude state-backed attacks.
