Binance: $6.34 billion targeted, $2.85 billion frozen or intercepted, net outflow unstated

Binance told reporters, in an account published by Ars Technica, that a campaign underway no later than June reached a withdrawal window nine days after 20 October. The company said attackers targeted $6.34 billion and that $2.85 billion was later frozen or intercepted. Between 17:15 and 19:56 UTC, a script on a third engineer's device called an internal wallet-signing service after a container deploy. Binance said the FBI and TRM Labs attributed the activity to North Korean actors. The Ars text does not quote an FBI case number or list transaction hashes.

The gap between $6.34 billion targeted and $2.85 billion frozen or intercepted is $3.49 billion. That remainder is not, on the published record, a measured unrecovered theft. The Ars account supplies no transaction hashes, no CVE, and no malware hash for the claimed zero-day. It does supply a sequence: a tampered Homebrew download in June, a September approach on a job platform, and 20 October use of an internal AI tool to reach two other engineer devices. A linked Proof of Reserves page is a balance snapshot. It does not document a funded loss reserve.

The recruiter-and-trojanized-tool pattern predates this case. CISA advisory AA22-108A, published 18 April 2022 under the name TraderTraitor, described North Korean operators using fake hiring processes and modified crypto applications to reach keys and wallet systems. Public reports put the 21 February 2025 Bybit theft near $1.5 billion and the March 2022 Ronin theft near $625 million. A $6.34 billion targeted sum is not the same statistic as funds stolen. If only the unintercepted portion left Binance custody, this event may not exceed Bybit. The secondary account never states the net outflow.

The control failure, if the timeline holds, is a developer laptop with a route to a signing service, widened by an internal AI tool that could operate other engineer machines. A missed detection is not, by itself, proof of a zero-day; that label requires a hash and a vendor advisory, neither of which appears here. Customer impact depends on cleared on-chain withdrawals and on whether the announced set-aside is segregated assets or a book entry. The falsifiers are an FBI or Treasury wallet notice, published transaction IDs, and an attestation that ties reserves to this incident.