{
  "id": 18150478,
  "title": "Binance says hackers who stole billions in crypto spent months planning heist",
  "url": "https://urgent.news/2026/11/04/binance-says-hackers-who-stole-billions-in-crypto-spent-months",
  "topic": "finance",
  "section": "Finance & Markets",
  "published": "2026-11-04T16:06:03.000Z",
  "source": {
    "name": "Ars Technica",
    "slug": "ars-technica",
    "url": "https://arstechnica.com/information-technology/2026/11/binance-says-hackers-who-stole-billions-in-crypto-spent-months-planning-heist/"
  },
  "original_language": "en",
  "account": "Hackers who plundered billions of dollars worth of cryptocurrency from the Binance exchange had been meticulously planning their theft for months, according to the company. Binance disclosed on Tuesday that the cybercriminals utilized both social engineering tactics and cutting-edge malware during the heist. The FBI and TRM Security, a separate firm, have both linked the incident to North Korean actors. The breach initially targeted $6.34 billion in cryptocurrency held in Binance wallets, but the exchange has since frozen or reclaimed $2.85 billion of that amount. Binance has allocated funds to cover the losses incurred and provided a link to a Proof of Reserves page. This represents the largest sum ever targeted in a cryptocurrency theft. Advanced persistent threat actors allegedly began their operations in June and continued until the heist was successfully executed on the last Thursday, when they compromised an engineer's laptop and withdrew assets from several wallets. Binance described the threat actors as highly sophisticated and resourceful, a common trait in organizations that suffer major, public hacks.",
  "summary": "Techniques included laptop infections, compromised internal tooling, and fake job interviews.",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}