# Binance Faces Record $6.3 Billion Crypto Theft via DevOps Breach North Korean hackers exploited a compromised engineer's laptop to execute unauthorized massive withdrawals. - **Source:** [Security Affairs](https://brifing.si/source/e6c4f5ec-3e1b-4152-a932-056243bd56eb) - **Published:** 2026-10-30 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/92b6b3ae-1d17-47e4-94cf-573963feb1e6 ## Record Breaking Security Incident On October 29, 2026, Binance suffered the largest cryptocurrency theft in history, totaling approximately $6.36 billion. Blockchain analysis firm TRM Labs identified that the majority of these funds were moved across ten different blockchains within a twenty-minute window. This incident significantly surpasses the previous record of $1.5 billion stolen from Bybit in 2025. ## Compromised DevOps Infrastructure The breach originated from a compromised laptop belonging to a DevOps engineer. This access allowed attackers to infiltrate a service container, where they submitted unauthorized withdrawal transactions. Binance Co-CEO Richard Teng clarified that the attack was not a simple one-click exploit but a complex process involving multiple points of unauthorized system access. ## Attribution to State Actors Blockchain intelligence firms TRM Labs and Chainalysis have attributed the attack to the North Korean state-backed unit known as TraderTraitor, also tracked as Lazarus Group or APT38. Investigators observed stolen funds from this Binance exploit commingling with assets previously taken in the Bitget hack, confirming a high degree of confidence in this attribution. ## Asset Freeze and Recovery In response, issuers including Tether, Circle, and Ripple froze approximately $2.67 billion in stablecoins. Additionally, the Arbitrum Security Council froze 8,426 ETH and 74.6 million ARB. Despite these efforts, the attackers successfully bypassed some freezes by selling USDT to market makers and borrowing ETH against USDT on the Aave lending protocol. ## Binance Operational Response Binance immediately suspended deposits and withdrawals across several networks to conduct urgent security checks. The company cancelled permissions linked to the affected addresses and is currently collaborating with law enforcement and blockchain analysis firms. Co-CEO Richard Teng confirmed that Binance will cover all user losses using its own capital and the SAFU fund. ## Technical Security Limitations The incident highlights the inherent risks of hot wallets, which remain connected to the internet to facilitate rapid exchange transactions. While public blockchains provide transparency, they cannot verify who authorized a specific transaction or how an attacker gained system access. This event proves that blockchain transparency does not substitute for robust internal operational security. ## User Safety and Phishing Binance has warned users to remain vigilant against opportunistic scams following the incident. Attackers often exploit confusion by spreading fake announcements or posing as support staff to solicit account information. Users are advised to rely exclusively on official Binance channels and never share passwords or recovery phrases in response to any unsolicited messages. ## Future Transparency Commitments Binance plans to publish an updated Proof of Reserves once the recovery and investigation work is complete. While the company maintains that user funds are safe and fully covered, it has yet to provide a detailed technical explanation regarding the full scope of the breach. Further updates will be provided through official company communication channels. ## Sources covering this story - https://securityaffairs.com/202119/cyber-crime/6-3-billion-stolen-from-binance-in-attack-attributed-to-north-korea.html — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._