Attackers have stolen about $6.3 billion in cryptocurrency from Binance, reportedly the largest cryptocurrency exchange by daily trading volume, in what analysts describe as the biggest crypto theft on record. Binance says its initial investigation points to a compromised laptop belonging to one of its DevOps engineers as a possible entry point, and blockchain intelligence firms TRM Labs and Chainalysis have linked the theft to TraderTraitor, a North Korean hacking group behind earlier exchange heists.
The figures come from Binance's own incident updates and the blockchain analysts tracking the funds, as compiled by Malwarebytes. Binance says it has frozen around $3 billion with help from blockchain partners, and it has promised to cover all losses from its emergency fund and company funds.
A laptop, a service container, and 20 minutes
In an update on October 30, Binance said the attackers may have used the engineer's compromised laptop to access a service container and submit unauthorized withdrawal transactions. The exchange said it had found "no evidence of any wallet private key leak," and that investigators had identified additional breach points. Binance's leadership has also said the theft was not a one-click transfer riding on a single employee's permissions, but a more complex process.
TRM Labs estimates that about $6.36 billion left Binance wallets across ten blockchains, with most of it moving within about 20 minutes. Analysts have reported somewhat different totals for the frozen funds, so both the loss and the recovery figures should be read as developing estimates rather than a final accounting.
Why a DevOps laptop keeps coming up
The reported entry point fits TraderTraitor's established playbook. The group, also tracked as Jade Sleet and UNC4899, has repeatedly gone after the people who hold the keys to cloud and deployment infrastructure rather than after wallets directly. In September, researchers found its macOS backdoors on a DevOps engineer's laptop at an Indian IT company, and the group was previously tied to the $1.5 billion Bybit theft. The attribution in this case rests on on-chain analysis by TRM Labs and Chainalysis; neither Binance nor a government agency has confirmed it in the material published so far.
Binance users: go through official channels only
Binance.com users are affected; Binance.US was not. Malwarebytes advises users to:
- Open the Binance app or type the support site address yourself, rather than following links in messages that urge you to verify your account or claim compensation.
- Review your transaction history and account security settings, and report anything unexpected through official support, which offers options to disable an account and reset a password or two-factor authentication.
- Never share authentication codes, even with someone who claims to be helping with the incident.
- Treat anyone promising to recover cryptocurrency as a likely scammer. The FBI warned in 2023 that fake recovery services target people who have already lost crypto.
- Keep messages, wallet addresses and transaction details if you lose money to a related scam.
If the attribution holds, a single compromised workstation has produced a haul roughly four times the size of Bybit's. Every exchange will now be asking the same uncomfortable question: which engineers' laptops can reach a withdrawal pipeline, and what stands in between.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.