# Binance ties its $6.3 billion theft to a compromised DevOps engineer's laptop

Source: https://startwithidentity.com/blog/2026-10-30-binance-ties-6-3-billion-theft-to-a-compromised-devops-engineer-laptop/
Last updated: 2026-10-30
License: content by Start with Identity. Cite the source URL.

---

Binance said on October 30 that the theft of roughly $6.3 billion from its wallets the previous day began with a DevOps engineer's compromised laptop, BleepingComputer reported. That access let the attackers reach a service container and submit unauthorized withdrawal transactions. Binance said it has found no evidence of a leaked wallet private key, that the attacker "did not simply use one engineer's permissions," and that it has "uncovered additional points of breach." TRM Labs counts about $6.36 billion moved across ten blockchains, most of it in about 20 minutes from 20:05 UTC on October 29, and attributes the attack with high confidence to TraderTraitor, North Korea's hacking unit. Stablecoin issuers and Arbitrum's Security Council froze about $2.7 billion. Binance suspended deposits and withdrawals, says user funds are safe and will cover losses from its SAFU fund and company funds.

## Why it matters

The FBI attributed the 2025 Bybit theft to the same group, and that one also began on a developer's laptop, at wallet provider Safe{Wallet}. In both cases one engineer's device sat close enough to the transaction path that compromising it was a route to moving funds. Binance's own statement that one engineer's permissions were not enough suggests the attacker chained several footholds.

The controls are [privileged access](https://startwithidentity.com/guides/architecture/implementing-privileged-access-management/) basics applied to the highest-value path you have. Keep production signing and withdrawal services out of reach of everyday engineering workstations, require multi-party approval for any transaction-submitting change, and grant engineers [just-in-time access](https://startwithidentity.com/glossary/jit-access/) rather than standing rights. North Korea also works the hiring pipeline, as the [laptop farm charges](https://startwithidentity.com/blog/2026-10-13-doj-charges-14-and-shuts-40-laptop-farms-in-north-korean-it-worker-scheme/) showed. More cases are in our [breach incident database](https://startwithidentity.com/breaches/incidents/).

Source: [BleepingComputer](https://www.bleepingcomputer.com/news/security/binance-links-63-billion-crypto-theft-to-compromised-devops-laptop/)