Binance records US$6.3bn crypto theft following fake job recruitment campaign and operates without cyber cover

Incident timeline and execution

The five-month breach began in June when a staff member downloaded a tampered AI coding assistant installer. In September, attackers used a bogus recruitment campaign on a legitimate hiring site to deliver malicious code to a second engineer via a take-home test. On 20 October, the attackers used the compromised laptop and an internal AI tool to access wallet team computers, ultimately executing a script on 29 October that drained hot wallets. The FBI attributed the attack to the North Korean state-backed group TraderTraitor.

Insurance and balance sheet impact

According to Bloomberg Law, Binance held no cyber insurance to cover the loss, reflecting wider market availability issues for digital-asset firms. Standard crime wordings are typically drafted for physical cash and securities, while cyber wordings often exclude digital-asset transfers unless specifically added. Furthermore, state-backed attack exclusions under Lloyd’s Market Bulletin Y5381 and traditional war exclusions create complexities for policyholders when attacks are attributed to nation-states. Binance absorbed the loss using its Secure Asset Fund for Users, a futures insurance fund, and corporate treasury reserves, while approximately US$2.85bn of the stolen assets has been frozen by stablecoin issuers.