Binance ties its $6.3 billion theft to a compromised DevOps engineer's laptop

Binance said on October 30 that the theft of roughly $6.3 billion from its wallets the previous day began with a DevOps engineer's compromised laptop, BleepingComputer reported. That access let the attackers reach a service container and submit unauthorized withdrawal transactions. Binance said it has found no evidence of a leaked wallet private key, that the attacker "did not simply use one engineer's permissions," and that it has "uncovered additional points of breach." TRM Labs counts about $6.36 billion moved across ten blockchains, most of it in about 20 minutes from 20:05 UTC on October 29, and attributes the attack with high confidence to TraderTraitor, North Korea's hacking unit. Stablecoin issuers and Arbitrum's Security Council froze about $2.7 billion. Binance suspended deposits and withdrawals, says user funds are safe and will cover losses from its SAFU fund and company funds.

Why it matters

The FBI attributed the 2025 Bybit theft to the same group, and that one also began on a developer's laptop, at wallet provider Safe{Wallet}. In both cases one engineer's device sat close enough to the transaction path that compromising it was a route to moving funds. Binance's own statement that one engineer's permissions were not enough suggests the attacker chained several footholds.

The controls are privileged access basics applied to the highest-value path you have. Keep production signing and withdrawal services out of reach of everyday engineering workstations, require multi-party approval for any transaction-submitting change, and grant engineers just-in-time access rather than standing rights. North Korea also works the hiring pipeline, as the laptop farm charges showed. More cases are in our breach incident database.

Source: BleepingComputer