Binance: record $6.3 billion theft traced to a DevOps laptop

On 29 October 2026 about $6.3 billion in cryptocurrency left Binance’s hot wallets, the internet-connected wallets the exchange uses to process withdrawals. Binance has confirmed the incident and, in its first findings, links it to the compromised laptop of a DevOps engineer. Blockchain analytics firms TRM Labs and Chainalysis attribute it with high confidence to TraderTraitor, the North Korean group the FBI blamed for the $1.5 billion Bybit theft in February 2025. If the figures are confirmed, it is the largest cryptocurrency theft on record.

The story is reported by BleepingComputer, Security Affairs, TechCrunch, The Hacker News, The Register, SecurityWeek, Help Net Security and The Record.

What happened

• 29 October, from 20:05 UTC: according to TRM Labs, about $6.36 billion leaves Binance wallets, most of it within roughly 20 minutes. TRM counts ten blockchains; The Record instead writes 20 blockchains, including Bitcoin, Ethereum, Tron, the XRP Ledger and Solana.
• In the first hours, public estimates based only on observed transactions range from $2 billion to $5.8 billion. Binance says it is investigating and that user funds are “completely safe”, then suspends deposits and withdrawals. According to The Register, trading was halted too.
• 30 October: in its first technical update Binance raises the estimate to $6.3 billion, says it has frozen about $3 billion with help from partners and pledges to cover all losses from its SAFU fund and company funds. According to Help Net Security, deposits have resumed, while withdrawals stay paused until a security overhaul of the withdrawal service and related addresses is complete, with resumption expected within 48 hours.

Technical details

Binance’s account. The initial investigation indicates that the DevOps engineer’s compromised laptop let the attacker access a service container and submit unauthorised withdrawal transactions. Binance says it found no evidence of a wallet private key leak. Co-CEO Richard Teng stresses that the attacker “did not simply use one engineer’s permissions” and that this was not a “one-click” action but a more complex process; the company reports “additional points of breach” still under analysis. Authorisation for the affected address has been revoked and a technical post-mortem has been promised. Binance has not explained how the laptop was compromised: The Register suggests phishing or a compromised software package, but that is only a hypothesis.

TRM Labs’ analysis (reported by SecurityWeek, Help Net Security and BleepingComputer):

• preparation: at least a day and a half. The wallet used to run the operation was funded with small Tornado Cash withdrawals, and the malicious code was tested on other wallets before the attack;
• Ethereum: the attackers used EIP-7702, the mechanism that lets an ordinary wallet delegate its behaviour to a smart contract by signing an authorisation. They submitted 50 authorisations signed in advance by a Binance hot wallet, so that one would match the transaction counter (nonce) at execution time. The wallet ended up delegated to a contract only the attackers could control, which they used to drain it;
• the other blockchains: Binance wallets sent funds through ordinary, validly signed transactions, despite using different key types and signing schemes, all within about half an hour. TRM’s most likely explanation is that the attacker gained the ability to make Binance’s hot wallet signing system sign transactions of its choosing. Phishing, which first seemed to explain Ethereum, does not explain the other chains.

The two accounts are compatible: a signing service can be abused without the keys ever leaving the system.

Attribution. TRM attributes the attack to TraderTraitor (also tracked as Lazarus Group and APT38) based on similarities with Bybit and with the April 2026 KelpDAO attack: an operator wallet funded through a mixer, long preparation, and signatures collected in advance and used all at once. Chainalysis reaches the same conclusion after finding proceeds from last month’s Bitget theft mixed with funds taken from Binance. Binance has not named the perpetrators.

Freezes and laundering. Tether froze more than $1.56 billion in USDT and Circle more than $800 million in USDC; Ripple, World Liberty Financial and Arbitrum’s Security Council froze smaller amounts. TRM counts about $2.7 billion frozen, Binance about $3 billion. To stay ahead of the freezes, the attackers sold USDT to market makers at more than 10% below market price and borrowed ETH on Aave against USDT. According to TRM they still control more than 420,000 ETH and 18,270 BTC, about $2.4 billion that no issuer can freeze.

MITRE ATT&CK (our mapping from the reported facts): T1657 (Financial Theft). The initial access vector has not been disclosed.

Impact for European and Italian companies

For anyone holding funds on Binance, the immediate effect is the withdrawal freeze and the risk of phishing: Binance itself warns users not to trust links, messages or requests for account information from unofficial channels. Crypto-asset service providers authorised under MiCA fall within the scope of DORA, with its obligations on ICT risk and incident reporting.

The lesson, however, goes well beyond cryptocurrency. One laptop belonging to someone who runs the infrastructure was enough to reach a production container and, from there, a service that signs high-value operations. The same pattern applies to payments, signed software releases, internal CAs and keys in a KMS or HSM: if the service signs whatever it is asked to, protecting the key is not enough. For NIS2 entities, Article 21 requires measures on access control, secure development and incident handling, and DevOps workstations are part of that.

What to do right now

1. Funds on Binance: use official channels only and warn whoever manages your treasury that fake announcements and fake support staff will circulate.
2. DevOps and admin workstations: treat them as critical systems. Use dedicated admin workstations, no direct production access from everyday laptops, short-lived credentials and strong authentication.
3. Access to production containers: check who can open a session or run commands inside containers, log every session and alert on access outside working hours or from new devices.
4. Signing services: add rules that do not depend on who makes the request, such as amount and frequency limits, approved destinations and multi-person approval above a threshold. Plan an emergency stop: here most of the funds left within 20 minutes.
5. Pre-signed authorisations: if you manage wallets, prevent the system from signing unexpected EIP-7702 delegations and check whether ready-made, unused signatures exist.
6. Exchanges and services accepting crypto deposits: TRM advises screening incoming deposits against the addresses it has linked to the theft.

How ARXDOME helps

ARX Sentry uses its agent to collect logs, security events, processes and file changes from Windows, Linux and macOS computers and servers, including developer and DevOps workstations. The SOC identity pages show privileged access, night-time logins and bursts of attempts. With ARX Trace, analysts run collections and searches across multiple machines to find out whether a workstation is compromised and where the attacker moved next.

Last updated: 30 October 2026