Binance: $6.3 billion stolen from its hot wallets, a DevOps laptop as the first lead, and the FBI points to North Korea

Binance confirms that its hot wallets were compromised on 29 October, with losses of about $6.3 billion, and first traced the intrusion to a DevOps engineer’s laptop before finding other points of breach. According to BleepingComputer, the FBI attributes the theft to the North Korean group TraderTraitor.

What happened

Binance says its hot wallets were compromised around 20:05 UTC on 29 October 2026, allowing unauthorised withdrawals worth about $6.3 billion. TRM Labs, which puts the figure at $6.36 billion, reports that the funds left on ten blockchains, most of them within about 20 minutes, and calls it the largest crypto theft on record. According to BleepingComputer, the FBI published an alert on 31 October attributing the theft to TraderTraitor, a North Korean state-backed group; with the Secret Service and IRS Criminal Investigation, it asked exchanges to block 628 addresses tied to the laundering.

How the attackers got in

Binance’s first update pointed to a DevOps engineer’s compromised laptop, used to reach a service container and submit withdrawal transactions. Its next update says later findings showed additional points of breach. The company reports no evidence that wallet private keys leaked and promises a post-mortem. According to BleepingComputer, a co-CEO said the attacker did more than use one engineer’s permissions, and that no individual has been held responsible. TRM Labs considers control of the hot wallet signing infrastructure the most likely explanation; Binance has not published a root cause.

Binance reports about $3 billion frozen on-chain and says it will absorb the loss. On 1 November it stated that about 95% of the amount was covered, that deposits were unaffected and that a first phase of withdrawals was scheduled from 06:00 to 09:00 UTC that day.

What to do now

1. Dedicate admin workstations: no e-mail or general browsing on a machine that holds production access.
2. Remove long-lived secrets from laptops: check ~/.ssh, ~/.kube/config and cloud credential files, then move to short-lived access through SSO with hardware-key MFA.
3. Measure what a laptop can do: run kubectl auth can-i --list with an administrator’s credentials, remove what is not needed and block direct access from workstation networks to production containers.
4. Require a second approval for irreversible actions: bulk exports, backup deletion, payments.
5. Set volume alerts with an automatic stop: a 20-minute drain leaves no time for a human decision.

Our take

Few companies hold billions, but almost all of them have an administrator’s laptop that can reach production. Whatever the post-mortem finally establishes, the design goal stays the same: one compromised machine must never be enough to trigger an irreversible action. Revoking access quickly is also worth rehearsing before it is needed.

Sources

• Binance — Security Incident Update
• Binance — Security Incident Update #2
• Binance — Security Incident: Recovery Update #4
• TRM Labs — North Korea steals USD 6.36 billion from Binance
• BleepingComputer — FBI links $6.3 billion Binance crypto heist to North Korean hackers
• BleepingComputer — Binance links $6.3 billion crypto theft to compromised DevOps laptop

How we choose, verify and write our analyses →