After the Binance theft, a wave of phishing: how to secure your account and spot fake emails

At the end of October 2026, more than $6bn was stolen from the Binance cryptocurrency exchange. According to Polish media, it is the largest theft in crypto history. Now the exchange's users have to watch out for another threat: messages from scammers.

What is known about the attack

The US FBI has officially named those responsible. According to the bureau's statement, North Korea is behind the attack, specifically the hacking group TraderTraitor. As Antyweb describes it, the attackers did not break in by brute force. Instead, they ran fake job interviews and used them to infect the laptops of Binance engineers. The authorities in Pyongyang have rejected the accusations.

The FBI said the stolen assets are being converted into ethereum and that it expects further stages of money laundering. According to Bankier.pl, citing analysts, the hackers still control assets worth about $3.3bn. Industry firms have frozen the rest.

Binance says its customers have not suffered losses. On Saturday the exchange posted on X that it had restored 90% of the stolen assets from its own funds and reserve funds. It also announced that it would resume withdrawals, suspended after the attack, on Sunday 1 November. Antyweb reports that 98% of the losses have been covered.

Fake emails about a "refund"

Antyweb warns of a wave of phishing. Scammers pose as Binance support and send messages such as an approved refund request, an urgent wallet verification, or a prompt to synchronise a Web3 wallet with a "new security contract". The links lead to fake login pages that capture login details.

According to the warning, Binance never asks for a seed phrase. Nor does it require you to install external "fund recovery" tools or send direct login links in disputed matters.

Four steps recommended to users

1. Log in only through official channels. It is best to type the exchange's address into the browser yourself and not click links in emails or social media. According to Antyweb, withdrawals of major cryptocurrencies are working normally, but some smaller tokens may still be blocked.
2. Review account security. It is worth deleting old API keys, and regenerating those used in bots, portfolio-tracking apps or tax calculators. It is also worth enabling a withdrawal address whitelist and passkeys or a hardware key instead of SMS codes.
3. Check that your funds are covered. Binance publishes Proof of Reserves. After logging in, a user can check whether their balance is backed by the exchange's wallets.
4. Don't keep your savings on an exchange. Antyweb reminds readers that an exchange is for trading. The author advises keeping long-term assets in a hardware wallet.

What this means for you

Binance has many users in the UK too, so messages about a "refund" may reach people living in the UK. The sources do not describe the rules for British customers, so it is worth checking the exchange's notices for your country. The basic rule is the same everywhere: do not click links in emails and never give anyone your seed phrase.