# Binance traces $6.3 billion theft to one engineer's hacked laptop as investigators name North Korea's TraderTraitor

About $3 billion of the stolen assets is frozen, Binance has set aside $6.34 billion of its own funds, and the exchange plans to restart withdrawals on Sunday and publish proof of reserves on Monday.

- Published: 2026-10-31T05:43:59.168Z
- Canonical: https://polylog.news/crypto/2026-10-31/binance-traces-6-3-billion-theft-to-one-engineer-s-hacked-la
- Publisher: Polylog (Crypto desk)
- Section: crypto
- Sources: [CoinDesk](https://www.coindesk.com/tech/2026/10/30/binance-uncovers-wider-breach-in-usd6-3-billion-exploit-targets-sunday-withdrawal-restart), [CoinDesk](https://www.coindesk.com/markets/2026/10/31/bitcoin-stolen-from-binance-tops-tesla-s-holdings-and-is-over-twice-el-salvador-s-reserve), [CoinDesk](https://www.coindesk.com/business/2026/10/30/binance-arranges-usd6-34-billion-to-cover-losses-from-record-crypto-hack), [Polylog editors](https://polylog.news), [Bitcoin Magazine](https://bitcoinmagazine.com/news/north-korea-6-3-billion-binance-hack), [Bitcoin Magazine](https://bitcoinmagazine.com/videos/what-to-know-about-the-6-3-billion-binance-hack), [Yahoo Finance](https://finance.yahoo.com/markets/crypto/articles/binance-6-3-billion-hack-083916125.html), [Hackread](https://hackread.com/binance-devops-engineer-hacked-laptop-billion-theft/)

Binance [disclosed in a blog post](https://t.me/BWEnews/16589) that the theft began with a compromised laptop. The laptop belonged to a DevOps engineer, a staff member who runs software deployment and infrastructure. According to the exchange's [preliminary findings](https://hackread.com/binance-devops-engineer-hacked-laptop-billion-theft/), the attacker may have used that access to enter a service container and submit unauthorized withdrawal transactions. Binance said it found no evidence that wallet private keys leaked. In plain terms, the attacker did not steal the keys. The attacker gained control of a system authorized to request signatures.

The attack on October 29 hit wallets on 10 blockchains. TRM Labs put the loss at $6.36 billion, with most transfers made in [about 20 minutes](https://finance.yahoo.com/markets/crypto/articles/binance-6-3-billion-hack-083916125.html). CoinDesk [calls it a record crypto hack](https://www.coindesk.com/business/2026/10/30/binance-arranges-usd6-34-billion-to-cover-losses-from-record-crypto-hack). The bitcoin portion alone is [18,270 BTC, worth about $1.4 billion](https://www.coindesk.com/markets/2026/10/31/bitcoin-stolen-from-binance-tops-tesla-s-holdings-and-is-over-twice-el-salvador-s-reserve). That is more than Tesla holds, more than twice El Salvador's reserve, and 442 coins short of SpaceX's disclosed holdings. On Ethereum, the attacker used a 2025 wallet-delegation feature to sweep the hot wallet. The next article covers that mechanism.

Chainalysis and TRM Labs [linked the theft to TraderTraitor](https://bitcoinmagazine.com/news/north-korea-6-3-billion-binance-hack), a North Korean state-backed unit that TRM associates with the Lazarus Group. Both firms sell tracing services and gain from high-profile attributions. Their call matches the pattern of earlier exchange hacks, but no government has published its own attribution. A Reuters source said Binance is [working with the Federal Bureau of Investigation (FBI) and the US Secret Service](https://t.me/BWEnews/16591). A day after the theft, Watcher Guru relayed a [North Korean statement that international sanctions do not work](https://t.me/WatcherGuru/15736).

Binance Chief Executive Richard Teng said the breach was [wider than first found](https://www.coindesk.com/tech/2026/10/30/binance-uncovers-wider-breach-in-usd6-3-billion-exploit-targets-sunday-withdrawal-restart). He said the hackers erased evidence and bypassed security checks. Binance aims to restart withdrawals on Sunday and to publish proof of reserves on Monday. The exchange said it has [reserved $6.34 billion of its own funds](https://www.coindesk.com/business/2026/10/30/binance-arranges-usd6-34-billion-to-cover-losses-from-record-crypto-hack) to cover customers. Industry partners have frozen about [$3 billion](https://t.me/cointelegraph/72966), including more than $2.5 billion by Tether and Circle. Bitcoin Magazine counts [$3.3 billion as unrecovered](https://bitcoinmagazine.com/videos/what-to-know-about-the-6-3-billion-binance-hack).

## What this means

The failure occurred inside Binance's operations, in a signing service that worked as designed after an attacker reached it. It was not a smart-contract bug. That shifts the exposure from code to staff devices, deployment systems and internal permissions, areas audits rarely cover. The precedent is Bybit in February 2025. That roughly $1.5 billion theft was also attributed to TraderTraitor, and only a small share was ever frozen. This time about half was frozen, because a large part of the loot was in stablecoins whose issuers can block them. Markets already expect Binance to stay solvent, since it says it holds $6.34 billion in reserve. Markets have not tested what happens when withdrawals reopen. The likelier outcome is that withdrawals resume within days. Net outflows to rival exchanges and self-custody would follow for several weeks but stay within what Binance's own funds can cover. That depends on Monday's proof of reserves showing liabilities fully backed after the reserved $6.34 billion. A delay in either the withdrawal restart or the reserve report would prove this read wrong.

## What to watch

- Whether Binance actually reopens withdrawals on Sunday and how much leaves in the first 48 hours. Large, sustained outflows would show customers doubt the $6.34 billion backstop.
- Monday's proof-of-reserves report, and whether it lets outsiders check liabilities as well as assets. A report that shows only assets would not settle the solvency question.
- Whether the FBI or the Treasury Department issues its own attribution to North Korea. A government finding would allow sanctions designations of laundering addresses and of the services that touch them.