Binance Links $6.3 Billion Crypto Theft to Compromised DevOps Laptop

Binance has reported that an estimated $6.3 billion in cryptocurrency was stolen following the compromise of a DevOps engineer's laptop, according to a statement shared with BleepingComputer. The exchange stated that the unauthorized access allowed attackers to submit unauthorized withdrawal transactions after reaching a service container, though no leaked wallet private key has been identified yet.

Binance Co-CEO Richard Teng clarified that the attack was complex, involved multiple steps rather than a simple permission bypass or single-click action, and that the ongoing investigation has not assigned responsibility to any specific individual. The company also noted that additional breach points were uncovered and investigations remain ongoing.

Incident Response and Asset Recovery

• Platform Actions: Binance suspended deposits and withdrawals to conduct security checks, revoked authorizations for the affected address, and partnered with law enforcement and blockchain intelligence firms.
• User Protection: Binance confirmed that customer funds remain safe and announced that losses will be covered using the SAFU fund and corporate reserves, with an updated Proof of Reserves to follow remediation.
• Stablecoin Freezes: Issuers including Tether, Circle, Ripple, and World Liberty Financial, alongside Arbitrum's Security Council, successfully froze roughly $2.7 billion in assets.

External Attribution to North Korean Hackers

While Binance did not publicly name a threat actor, blockchain analysis firms TRM and Chainalysis attributed the incident to TraderTraitor, a North Korean state-backed hacking unit also tracked as Lazarus Group and APT38. TRM reported that approximately $6.36 billion was moved out of Binance wallets across ten blockchains on October 29, 2026.

Despite the freezes by stablecoin issuers, the attackers reportedly retained control of roughly $2.4 billion in assets, including over 420,000 ETH and 18,270 BTC, by selling USDT to market makers and borrowing ETH on Aave to outpace the freeze actions. Verification of these events can be pursued through official announcements from Binance, blockchain intelligence reports, and law enforcement updates.