Binance Links $6.3 Billion Cryptocurrency Theft to Compromised DevOps Engineer’s Laptop

Cryptocurrency exchange Binance has linked a massive theft involving approximately $6.3 billion in digital assets to a compromised laptop belonging to a DevOps engineer, raising serious concerns about internal security controls and the protection of cryptocurrency infrastructure.

According to Binance, attackers gained access through the compromised laptop and subsequently reached a service container that allowed them to submit unauthorized withdrawal transactions.

The company stated that its investigation has not identified evidence of leaked wallet private keys. However, investigators discovered additional potential points of compromise and continue examining how the attackers moved through the exchange’s internal systems.

Binance Co-CEO Richard Teng emphasized that the incident was not simply the result of one employee’s permissions or a single action. Instead, the attack involved a more complicated sequence of events, and the investigation has not attributed responsibility to any individual.

The exchange temporarily suspended deposits and withdrawals while conducting security checks, revoked authorizations associated with the affected address, and began working with blockchain intelligence companies and law enforcement agencies to trace the stolen assets.

Binance also reassured customers that their funds were safe and promised to cover all losses through its Secure Asset Fund for Users (SAFU) and company resources. The exchange said it would publish an updated proof of reserves after completing remediation efforts.

Blockchain intelligence firm TRM Labs reported that approximately $6.36 billion was transferred from Binance wallets across ten blockchains on October 29, 2026. Most of the transactions reportedly occurred within approximately 20 minutes.

TRM attributed the incident to TraderTraitor, a North Korean state-backed hacking group also associated with the Lazarus Group and APT38. Blockchain analysis company Chainalysis also expressed high confidence in this attribution.

Following the incident, cryptocurrency issuers and blockchain security organizations moved to freeze portions of the stolen assets. Approximately $2.7 billion in cryptocurrency was reportedly frozen through coordinated actions involving Tether, Circle, Ripple, and other organizations, alongside blockchain network security measures.

However, investigators believe the attackers still control approximately $2.4 billion in assets that cannot be frozen through centralized issuers.

The incident is considered the largest recorded cryptocurrency theft, significantly exceeding the approximately $1.5 billion stolen during the 2025 Bybit attack.

The investigation remains ongoing as Binance and blockchain intelligence specialists work to identify the full attack chain and recover the stolen funds.