One DevOps Laptop Opened the Door to Binance’s $6.3 Billion Theft
Binance traces the $6.3 billion Oct. 29 theft to a compromised DevOps engineer's laptop. TRM Labs and Chainalysis blame North Korea's TraderTraitor; about $2.7 billion is frozen and Binance says users are covered.
Binance says the roughly $6.3 billion stolen from its wallets on Oct. 29 traces back to one compromised laptop belonging to a DevOps engineer. BleepingComputer reports the attacker used that foothold to get into a service container and push through withdrawals it never authorized. TRM Labs calls it the largest crypto theft on record and blames North Korea.
For defenders
What Binance has said: the theft started from the engineer’s laptop, reached a service container and submitted unauthorized withdrawal transactions. It was a multi-step attack, not one person’s permissions misused, and Binance isn’t blaming the engineer. It has found no sign a wallet private key leaked, and says there are “additional points of breach” it hasn’t described yet. How the laptop was compromised, what malware was used and which credentials were taken are not disclosed, and no indicators have been published.
Scale and speed: TRM puts the haul at $6.36 billion across ten blockchains, about four times the Bybit theft of February 2025. Most of it moved within about 20 minutes starting at 20:05 UTC. Stablecoin issuers Tether, Circle, Ripple and World Liberty Financial froze about $2.67 billion, and Arbitrum’s Security Council froze 8,426 ETH and 74.6 million ARB. TRM says the thief still controls more than 420,000 ETH and 18,270 BTC, roughly $2.4 billion out of reach.
Attribution: TRM attributes it to TraderTraitor, the North Korean unit also tracked as Lazarus Group and APT38, and Chainalysis says it agrees with “a high degree of confidence.” Binance hasn’t named anyone. The end goal is plain T1657 (Financial Theft); the route in, through an engineer’s machine rather than the exchange’s front door, is the part every company should study once Binance publishes details.
The lesson for any company with high-value systems: an engineer laptop that can reach production containers is as valuable as the production keys. Withdrawal paths need controls a single compromised workstation can’t satisfy, such as hardware-backed signing and a second approver outside that machine.
What it means for you
If you hold crypto on Binance, the exchange says every loss is covered from its SAFU emergency fund and company money, and customer balances are safe. Deposits and withdrawals were paused during the checks, so expect delays. Expect scammers too: fake “Binance refund” or “verify your wallet” messages will follow a story this big. Binance won’t ask for your password or recovery phrase.
Do this now
- Ignore any message offering a Binance refund or compensation; check announcements only in the official app or website you type in yourself.
- Turn on a strong second login step for exchange accounts; a hardware security key is the strongest option.
- If you run engineering teams, review which developer laptops can reach production and payment systems, and require a second approval for anything that moves money.