DevOps Engineer's Compromised Laptop Triggers $6.3 Billion Binance Withdrawal as Attackers Abuse Internal Access

Binance Suffers Record $6.3 Billion Hot Wallet Theft Attributed to North Korean TraderTraitor Group

On October 29, 2026, Binance disclosed that attackers had drained approximately $6.3 billion in digital assets from its hot wallets, far exceeding the previous record of $1.5 billion stolen from Bybit in February 2025. The FBI attributed the operation to the TraderTraitor group, widely identified as the North Korean Lazarus Group, which converted stolen tokens into Ethereum and prepared to launder proceeds through decentralized finance platforms and instant exchangers. Binance stated that 90 percent of losses were covered using its SAFU reserve, futures insurance fund, and corporate treasury totaling roughly $6.34 billion, though this represents replenishment rather than recovery of assets from the attackers. The breach originated from a compromised DevOps engineer's laptop that granted access to signing infrastructure, with additional malware used to erase forensic traces; blockchain analysis by TRM Labs linked the timing and tactics to prior campaigns against Bybit and KelpDAO. The incident contributed 2.3 percentage points to the Cassandra Index, pushing the weekly score to 72 and driving the largest regional increase in East Asia. The theft underscores how North Korean state actors rely on cryptocurrency operations to fund weapons programs despite international sanctions.

Binance Confirms Record $6.3 Billion Crypto Theft via Compromised Hot Wallet and EIP-7702 Exploit

Binance reported on October 30, 2026, that attackers stole approximately 6.3 billion dollars in cryptocurrency, marking the largest theft in the sector. The breach occurred on October 29 when unauthorized transfers drained a hot wallet over roughly 20 minutes after the attacker compromised the transfer authorization system. TRM Labs and Chainalysis attributed the operation with high confidence to the North Korean group TraderTraitor, linked to Lazarus, though Binance stated its own investigation has not yet identified the perpetrators. The attacker leveraged Ethereum's EIP-7702 feature to seize control of the wallet after preparing the operation for at least 36 hours, bypassing private key theft by forcing the exchange infrastructure to sign the transfers. Roughly 3 billion dollars have been traced and partially frozen with assistance from Tether and Circle, while Binance pledged to cover all losses through its SAFU fund and corporate capital. The exchange suspended withdrawals across multiple networks, restored deposits the following day, and is working with the FBI and U.S. Secret Service on the investigation.

Binance Halts Deposits and Withdrawals After Suspected $6.3 Billion Breach via Compromised DevOps Laptop

Binance suspended all deposits and withdrawals following a major security incident that potentially exposed around $6.3 billion in assets. The exchange believes the attacker gained initial access through a compromised laptop belonging to a DevOps engineer, which may have allowed unauthorized transactions from a service container. No evidence of private key leakage from wallets has been found so far. The company has frozen approximately $3 billion in blockchain assets with partner assistance and revoked authentication for the affected address. Binance stated it will cover all losses using its SAFU fund and internal resources, then publish updated proof of reserves once the incident is resolved. The investigation remains ongoing, with the laptop compromise theory still preliminary, and a full technical report will be released later.