Binance traces $6.3 billion theft to one engineer's hacked laptop as investigators name North Korea's TraderTraitor

Binance disclosed in a blog post that the theft began with a compromised laptop. The laptop belonged to a DevOps engineer, a staff member who runs software deployment and infrastructure. According to the exchange's preliminary findings, the attacker may have used that access to enter a service container and submit unauthorized withdrawal transactions. Binance said it found no evidence that wallet private keys leaked. In plain terms, the attacker did not steal the keys. The attacker gained control of a system authorized to request signatures.

The attack on October 29 hit wallets on 10 blockchains. TRM Labs put the loss at $6.36 billion, with most transfers made in about 20 minutes. CoinDesk calls it a record crypto hack. The bitcoin portion alone is 18,270 BTC, worth about $1.4 billion. That is more than Tesla holds, more than twice El Salvador's reserve, and 442 coins short of SpaceX's disclosed holdings. On Ethereum, the attacker used a 2025 wallet-delegation feature to sweep the hot wallet. The next article covers that mechanism.

Chainalysis and TRM Labs linked the theft to TraderTraitor, a North Korean state-backed unit that TRM associates with the Lazarus Group. Both firms sell tracing services and gain from high-profile attributions. Their call matches the pattern of earlier exchange hacks, but no government has published its own attribution. A Reuters source said Binance is working with the Federal Bureau of Investigation (FBI) and the US Secret Service. A day after the theft, Watcher Guru relayed a North Korean statement that international sanctions do not work.

Binance Chief Executive Richard Teng said the breach was wider than first found. He said the hackers erased evidence and bypassed security checks. Binance aims to restart withdrawals on Sunday and to publish proof of reserves on Monday. The exchange said it has reserved $6.34 billion of its own funds to cover customers. Industry partners have frozen about $3 billion, including more than $2.5 billion by Tether and Circle. Bitcoin Magazine counts $3.3 billion as unrecovered.