Decoding the $6.3 Billion Binance Heist

0:00What we noticed more is that we've moved AI off the screen into the physical world. That's Tanguy Katlan, senior partner at McKinsey and director of the McKinsey Global Institute. AI, he says, no longer lives in a computer, but is tangible in robotics, engineering, space travel, and more. One of the 14 key points identified by McKinsey in its 2026 Technology Trends Outlook. At the break, join McKinsey to learn how these trends are shaping innovation and how leaders should respond.

0:33How do you steal$6.3 billion? Hard to figure out. We're still trying to figure it out. Welcome to Tech News Briefing. It's Thursday, November 5th. I'm Bob McMillan, and I'm here with my colleague Sam Kessler. Sam, do you want to introduce yourself? Because I don't think I could do it justice. Oh, thanks. Thanks for having me, Bob. So I'm, like you, I'm a reporter here at The Journal. I do data journalism and investigations. And over the past year plus, along with Bob, I've been looking a lot into crypto and cyber heists, specifically North Korean cyber heists. So this is a big week for both of us.

1:14October, what, 29th? Yeah. You actually texted me about this around, it was around 5 p.m. your time, I think. There's something going on. Yeah, so I just finished writing a story about a hack at Polymarket and I was scrolling Twitter and I saw a tweet about a potential hack at Binance. At that point, it was potential. So Binance is the biggest cryptocurrency exchange. It has a U.S.-based company. This was not the U.S.-based outfit. This was the international exchange, by far the largest part of Binance's business. And I saw this tweet. It looked like they might have been losing money from one of their accounts in a way that was hard to explain.

2:03And immediately, I think it was pretty immediate, I gave you a call bomb. I was like, hey, if the numbers I'm looking at are right, I think this might be the biggest cyber heist of all time. And pretty quickly, we realized that was the case. Over the next few days, Sam, you kind of pieced together this hack. What actually happened? Yeah, so Binance has released a few statements. We've also learned a little bit about what was going on behind the scenes as this was all happening. So from the perspective of Binance, what happens is around 11 p.m. their time in the UAE, which is where they're predominantly headquartered, they saw that money was leaving one of their accounts.

2:44They alerted the executives at Binance immediately, and there was this group of around 100 people, a war room that was convened instantly with the top executives from the company. And they watched in real time as this money flowed out of their accounts,$1 billion,$2 billion, all the way up to what became$6.3 billion. Isn't there like a plug they could pull? They couldn't stop that from happening? That's crazy. I mean, it's only 20 minutes, right? And that's kind of one of the stunning things about this and crypto heists. It's like you can it's all code. You don't have to, you know, take a bunch of, you know, wads of cash and put them in a bag and get into a vault and get out.

3:26And no, it's just it's just code that's happening. And we'll talk a bit about what happened specifically and how this how this all specifically went down. But, you know, behind the scenes of Binance, I imagine it's it's mayhem. We just know that they've got this group together. And then they're talking in real time to their analytics partners, people who trace blockchain funds as they move, stuff like chain or firms like Chainalysis, TRM, Elliptic. These are three of the main blockchain tracing firms. They're trying to compile a list of all of the addresses that North Korea, as we'll talk about, it was a North Korean heist.

4:06They've been behind a lot of the largest crypto heists in recent memory. And the main thing they've got to do when they steal this money is they've got to launder it. And that starts by splintering the transactions or splintering the heist, like the stolen funds into a bunch of different wallets. And you've got these tracing people trying to figure out what these wallets are. And then they send them to crypto platforms so that those platforms can freeze any wallets that are associated with the heist. But only some crypto platforms can do that. There's this tracing nightmare that's going on. At the end of the day, what did they land on?

4:37How much did they lose? They lost that$6.3 billion, but they did manage to freeze around half of that. So it's around$3 billion that was frozen. And then we've got another$3 billion that these North Korean hackers have to figure out how to turn into assets that they can spend. But how did they do it? How did they get in? Yeah. So right now we know what Binance has told us. The story has gotten clearer over time, but it centers around two employees that were sabotaged. So maybe to back up a little bit, this hack, we were able to be the first to report with the help of some of our sources that this was a North Korean heist.

5:14And oftentimes what you see with these North Korean heists is they use social engineering, which is where they exploit a person's trust rather than exploiting computer code. It's not like they're writing up software and just hacking in from the outside. What they'll often do, as they did in this case, is they actually take advantage of a person who is inside the system, who is inside Binance. They get into their computer and then they leverage what they have access to there to exploit the company. So in this case, it's two. Yeah. So we know of two engineers. So the first engineer that they got into their device, they got into it because according to Binance, this employee had looked up Homebrew, which is a software package.

5:55It's like a popular package in software development. Any coder will know what it is. Somebody had looked up where to download it on Google and then were on a search engine. And then they downloaded a version of the software that was not authentic. It was a malicious version of the software that gave North Koreans keys into this computer. And so they had this corporate device. That's one of the engineers. So this is either like SEO optimization. They tricked the search engine to presenting this as a result when it was illegitimate or they bought an ad. Exactly. It's one of those two. So they're messing with the search engine.

6:30So that's kind of your frame of reality, right? Like, you know, people trust Google search results. So they're circumventing that. They get some malicious software on this engineer's laptop. And then what? Yeah, exactly. And then the next thing that we see, according to Binance, that they saw was another developer. Basically, this developer apparently was contacted on, all we know is that it was, according to Binance, a legitimate job hunting forum. I forget their exact wording, but somebody reached out from a fake company. And then this employee of Binance went to an interview, showed up, did the interview, then did another interview.

7:14And at this second interview, they were real people. These are with real people. So somebody is pretending to be a project director. But it was like it was it. I guess we don't know, but it might have been a North Korean or an agent for the North Koreans. Exactly. Maybe even an unwitting agent. Exactly. And then once they're there, they sent – and you see this happen often. This is one of the main ways that North Korean state-sponsored hacking groups. This one was called Trader Trader. It's one of the main ways that they'll get into people's devices. They'll get on a video conference with the victim.

7:47In this case, it was this employee who thought that they were interviewing at a company. The weird thing is that this employee conducted this interview on their corporate laptop. So imagine interviewing for another job on your work device. I don't know why they did that. But according to Binance, what happened was this interviewer who was fake told the interviewee, this Binance employee, to download a package onto their computer to conduct a coding assignment. So like a technical interview assignment where they write software code to be assessed. And the software package that they downloaded that they thought was a part of this interviewing process was actually laced with malicious code, which gave Binance another computer in Binance's network.

8:30All right, this feels like a good spot for a short break. When we come back, more on this fascinating story, the largest crypto heist of all time.

9:05Thank you. Later, Katlan explains how leaders identify the trends that matter most to their businesses.

9:18Sam, you and I worked on a project about North Korea and their entrance into this sort of fake employee world and just what a massive business that is. We got a pretty good look at the North Koreans. I mean, it's crazy how well, like you're talking about two things that are sort of like points of trust that they'd circumvented that I don't think most people are wary of right now. So like, you know, we trust our Google search results. Like usually I tell people if you get a phone call from a suspicious number, like put it into, you know, put the company name into Google and find out what their real point of contact is.

10:01Like we really trust Google. And then when you are worried about being tricked, like get somebody on the phone, you know, if you have a face-to-face interaction with them, that seems more trustworthy. They really understand how to hack the employment game. There's been a lot of concern around AI being used to facilitate hacks on big companies. and there was a lot of hypothesizing that this was an example of that. But even though we don't know how AI was used and it's possible that it was used to pull this off to maybe write these malicious software packages that people downloaded onto their computers, there is a lot of like sort of clandestine, almost like, you know, it almost feels like Cold War stuff where you have people, it's like very high touch, who are in, you know, just pretending to be somebody that they're not on a video conference with you, building your trust in past heists and in past hacks.

11:01We've seen this go on for months and months and months where they build up trust with a person and then they get into their system. It really is crazy how proficient North Korea's hackers have become. Do you have any understanding of how you get from just like two laptops to$6.3 billion? Have they made that clear at this point? Yeah. So Binance has explained some of this. They say that somebody who got into the device managed to use an internal AI platform and exploited that somehow to pull off this heist. They were able to get access to some of the wallet keys in a way or the ability to submit transactions in a way that looked like they were authentic Binance withdrawal requests, but they weren't actually authentic Binance withdrawal requests.

11:45There was also an update to Ethereum in 2025 that was exploited. It's not like they hacked into it, but they took advantage of a new feature on Ethereum in order to pull off this heist. So there was a level of technical proficiency here that we're still trying to piece together that was genuinely impressive to a lot of the investigators. It was definitely not easy. It wasn't a matter of just getting a password and then clicking a button. Well, what does it mean for Binance now? I mean, are they going to remain solvent? Are they going to be able to cover all the losses here? Yeah. Are they going to be trusted?

12:19Yeah. So Binance immediately said that they had basically, I think it was$5 billion already covered just from their balance sheet in the assets that were stolen. There was another billion dollars that they had to trade for. So they had the billion dollars on their books, but they then needed to turn those dollars into the assets that were actually stolen. And by now, they say that they did that and that users are going to be – it's not like users saw money leaving their accounts. Binance just saw money leaving from its accounts. But for all intents and purposes, they're telling us that users have been made whole as part of this.

12:55But in terms of what that means for Binance, there's a huge trust problem that they're now going to have to face where they've been seen as this sort of behemoth where they're in a world of a lot of different kinds of crypto firms that have been hacked and various different levels of credibility. Binance, by and large, was seen as at least one of the more legitimate cryptocurrency exchanges, a safer place to hold your funds. Now they're going to have to answer to a lot of people who are asking, hey, even though you made me whole, can I trust you in the future? Can I trust that all of your funds aren't going to be drained in a future heist and you're not going to put me in a situation where you can't fill the hole?

13:32And I am stuck depositing my money in a platform which, unlike a traditional bank, don't have the same sort of requirements, disclosure requirements, but also insurance, the same kind of insurance backing that at least a U.S. bank would have. So, Sam, how is this going to affect crypto? Is Bitcoin's value tanking because of this? Yeah. So, Bitcoin's value did go down within the first 24 hours of the attack. It went down 4 % or 5%. There's also going to be a lot of problems, you know, for the crypto industry as it tries to for years as it continues to try to convince people or persuade people away from the idea that it is just a platform for money laundering and for crime.

14:19One of the things that I'll be paying attention to over the next few weeks is how North Korea manages to launder all this money. And I imagine that we're, in addition to seeing scrutiny of crypto and its safety writ large, we're also going to be seeing scrutiny of those, you know, unique crypto platforms that are super useful for money laundering. Well, Sam, thanks so much for breaking this down. I had been just so eager to talk to you about this crazy hack. And I still have some questions, but I feel like I know now you can do a lot with two DevOps laptops and a crypto exchange. Thank you. Pretty crazy, isn't it?

15:00Thanks for having me. And that's it for Tech News Briefing. If you're a listener on Spotify, be sure to leave us a comment. Today's show was produced by Julie Chang with supervising producer Katie Ferguson. I'm Bob McMillan for The Wall Street Journal. We'll be back tomorrow with a new episode. Thanks for listening.

15:23Autonomy, absorption speed, cybersecurity, co-design of chips and models, unlocking the capacity that we need in the grid and energy. That's McKinsey's Tanguy Katlan, discussing five key themes outlined in McKinsey's 2026 Technology Trends Outlook, a comprehensive view of what's shaping today's tech landscape and where we might be tomorrow. Leaders, Katlan says, can examine the 14 trends McKinsey identifies and apply the learnings to their unique business context without chasing headlines. The competitive advantage comes from the intersection of proprietary data, workflows, and the ability to rewire the operating model, not from the trend that gets the most capital or gets the most attention in the press.

16:04It's how you're going to redesign your end-to-end workflows, take advantage of your own proprietary context and data, and the ability to rewire the operating model that helps you do talent. That's where actually you win. For more, visit McKinsey.com. This content was created by Custom Content from WSJ, a unit of the Wall Street Journal Advertising Department.