Overview
Binance, the world's largest cryptocurrency exchange, has confirmed that roughly $6.3 billion in digital assets was stolen after attackers compromised a DevOps engineer's laptop. Blockchain analytics firm TRM Labs calls it the largest crypto theft on record, about four times the $1.5 billion Bybit hack of February 2025.
Early reports on October 29 put the potential exposure at up to $5.8 billion. Binance later said about $6.3 billion in assets was affected and that close to $3 billion had been frozen on-chain.
Timeline
- October 29, 2026, 20:05 UTC — per TRM Labs, about $6.36 billion begins leaving Binance wallets across ten blockchains, most of it within roughly 20 minutes.
- October 29 — Binance suspends deposits and withdrawals for security checks and revokes authorizations for the affected address.
- October 30 — Binance confirms the incident and links it to the compromised laptop.
How the Attack Worked
According to Binance, the attackers accessed a service container from the compromised workstation and submitted unauthorized withdrawal transactions. Binance says it has found no evidence that a wallet private key leaked.
Co-CEO Richard Teng said the attacker "did not simply use one engineer's permissions" and that this was not a "one-click" action. Binance has "uncovered additional points of breach" and is still gathering facts.
Attribution
Binance has not attributed the attack to a specific group. TRM Labs attributes it to TraderTraitor, the North Korean state-backed unit also tracked as Lazarus Group and APT38. Chainalysis said it confirmed TRM's findings "with a high degree of confidence."
Frozen and Remaining Funds
- Tether, Circle, Ripple, and World Liberty Financial froze about $2.67 billion in stablecoins.
- Arbitrum's Security Council froze 8,426 ETH and 74.6 million ARB, bringing the total frozen to roughly $2.7 billion.
- TRM says the attacker still holds more than 420,000 ETH and 18,270 BTC (about $2.4 billion) beyond the reach of token issuers.
- The attacker "raced the freezes" by selling USDT to market makers and borrowing ETH against USDT on Aave.
Binance's Response
- Binance says it will cover all losses from the SAFU fund and company funds, and that user funds are safe.
- It is working with blockchain intelligence partners and law enforcement to trace and recover assets.
- An updated Proof of Reserves will be published once remediation is complete.
Lessons for Defenders
- Developer and DevOps endpoints are tier-0 assets. An engineer workstation with a path to production service containers is a direct path to signing and withdrawal infrastructure.
- Separate transaction authorization from workload access. Container access alone should not be enough to push high-value withdrawals; require out-of-band, multi-party approval.
- Rate and velocity limits matter. Billions leaving ten chains in 20 minutes suggests withdrawal-velocity controls did not stop the flow.
- Plan for freeze coordination. Pre-established contacts with stablecoin issuers and chain security councils determined how much was recoverable.
- Harden against social engineering. Prior DPRK operations, such as the 2026 Drift and KelpDAO incidents, relied on long-running social engineering of staff.
Sources
- BleepingComputer — Binance links $6.3 billion crypto theft to compromised DevOps laptop
- BleepingComputer — Binance probes potential $5.8 billion crypto-theft hack
- The Hacker News — Binance suffers security breach affecting $6.3 billion in assets