In a security update, the exchange said the intrusion began when an engineer was lured by a fake job interview and downloaded malicious software.
The attackers then moved through the company's network, exploited an internal AI tool, and reached a wallet signing service, a system that authorizes transactions.
That access let them send funds outside Binance's normal withdrawal process, and the theft took about 20 minutes.
Binance said it has set aside funds to cover the losses and has rebuilt or replaced affected internal systems.
Tracing firms quickly attributed the attack to North Korean hackers, specifically the TraderTraitor group, which stole more than $1.5 billion in a separate hack last year, and the FBI linked the group to the Binance theft on October 31.
Binance did not name the group itself but pointed to the FBI's attribution and said its security team detected and blocked 57 suspected North Korea-linked threat cases this year.
Rafe Pilling of the security company Sophos said the account fits the group's known approach: compromise engineers, learn how the environment works, then subvert the systems that approve transactions.
Binance also stressed that this was not a single breach or a simple phishing incident.
Roughly half the stolen money was frozen where the industry could do so, but billions remain under the hackers' control, and they are trying to launder it into a form they can cash out. Elliptic, a crypto tracing company, called the laundering highly complex and likely automated. TRM Labs estimates North Korea-linked hackers have stolen about $12 billion in crypto since 2017, more than half of it this year. A report from the Multilateral Sanctions Monitoring Team says successfully laundered funds could help finance the country's nuclear weapons and ballistic missile programs. Binance describes its findings as only the first step of its investigation.