Binance Links $6.3 Billion Cryptocurrency Theft to Compromised DevOps Laptop
Binance, the world's largest cryptocurrency exchange, has linked the theft of approximately $6.3 billion in digital assets to a compromised laptop belonging to a DevOps engineer. The exchange confirmed the breach involved unauthorized withdrawal transactions after attackers gained access to a service container.
BleepingComputer
Binance, the world's largest cryptocurrency exchange, has reported that the theft of approximately $6.3 billion in cryptocurrency was linked to a compromised laptop belonging to a DevOps engineer. The exchange stated that the unauthorized access allowed attackers to submit withdrawal transactions after gaining entry to a service container.
Binance Co-CEO Richard Teng emphasized that the attack was not a simple, single action. He clarified that the breach involved a complex process and that the company has not attributed responsibility to any specific individual. The exchange also noted that while additional points of breach were uncovered, the investigation remains ongoing.
On October 29, 2026, an attacker moved approximately USD 6.36 billion out of Binance wallets across ten different blockchains. This massive theft, which occurred primarily within a 20-minute window starting at 20:05 UTC, has been identified as the largest crypto theft on record.
Blockchain analysis firms have provided attribution for the incident. TRM Labs and Chainalysis confirmed that the attack was carried out by TraderTraitor, a North Korean state-backed hacking unit also tracked as Lazarus Group and APT38.
In response to the breach, Binance suspended all deposits and withdrawals while conducting security checks and revoking authorizations for the affected addresses. The company assured customers that their funds were safe and committed to covering all losses using both the SAFU fund and company reserves.
Efforts to freeze the stolen assets were underway, with stablecoin issuers including Tether, Circle, and Ripple, along with Arbitrum's Security Council, freezing roughly $2.7 billion. However, blockchain intelligence firms noted that the attackers managed to circumvent these freezes by selling USDT to market makers and borrowing ETH against USDT on Aave.
As a result of these maneuvers, the attackers currently maintain control over approximately $2.4 billion in assets, including over 420,000 ETH and 18,270 BTC, which remain beyond the reach of current freezes.
Binance is actively collaborating with law enforcement and blockchain intelligence partners to trace and recover the stolen funds. The company also announced plans to publish an updated Proof of Reserves once the remediation process is complete.