Binance Faces Record $6.3 Billion Crypto Theft via DevOps Breach
North Korean hackers exploited a compromised engineer's laptop to execute unauthorized massive withdrawals.
1Record Breaking Security Incident
On October 29, 2026, Binance suffered the largest cryptocurrency theft in history, totaling approximately $6.36 billion. Blockchain analysis firm TRM Labs identified that the majority of these funds were moved across ten different blockchains within a twenty-minute window. This incident significantly surpasses the previous record of $1.5 billion stolen from Bybit in 2025.
2Compromised DevOps Infrastructure
The breach originated from a compromised laptop belonging to a DevOps engineer. This access allowed attackers to infiltrate a service container, where they submitted unauthorized withdrawal transactions. Binance Co-CEO Richard Teng clarified that the attack was not a simple one-click exploit but a complex process involving multiple points of unauthorized system access.
3Attribution to State Actors
Blockchain intelligence firms TRM Labs and Chainalysis have attributed the attack to the North Korean state-backed unit known as TraderTraitor, also tracked as Lazarus Group or APT38. Investigators observed stolen funds from this Binance exploit commingling with assets previously taken in the Bitget hack, confirming a high degree of confidence in this attribution.
4Asset Freeze and Recovery
In response, issuers including Tether, Circle, and Ripple froze approximately $2.67 billion in stablecoins. Additionally, the Arbitrum Security Council froze 8,426 ETH and 74.6 million ARB. Despite these efforts, the attackers successfully bypassed some freezes by selling USDT to market makers and borrowing ETH against USDT on the Aave lending protocol.
5Binance Operational Response
Binance immediately suspended deposits and withdrawals across several networks to conduct urgent security checks. The company cancelled permissions linked to the affected addresses and is currently collaborating with law enforcement and blockchain analysis firms. Co-CEO Richard Teng confirmed that Binance will cover all user losses using its own capital and the SAFU fund.
6Technical Security Limitations
The incident highlights the inherent risks of hot wallets, which remain connected to the internet to facilitate rapid exchange transactions. While public blockchains provide transparency, they cannot verify who authorized a specific transaction or how an attacker gained system access. This event proves that blockchain transparency does not substitute for robust internal operational security.
7User Safety and Phishing
Binance has warned users to remain vigilant against opportunistic scams following the incident. Attackers often exploit confusion by spreading fake announcements or posing as support staff to solicit account information. Users are advised to rely exclusively on official Binance channels and never share passwords or recovery phrases in response to any unsolicited messages.
8Future Transparency Commitments
Binance plans to publish an updated Proof of Reserves once the recovery and investigation work is complete. While the company maintains that user funds are safe and fully covered, it has yet to provide a detailed technical explanation regarding the full scope of the breach. Further updates will be provided through official company communication channels.