Binance has determined that a $6.3 billion cryptocurrency theft originated from a DevOps engineer's compromised laptop, according to statements the exchange made public Thursday. The attackers leveraged access to a service container to execute unauthorized withdrawal transactions, though Binance said its investigation found no evidence that wallet private keys were leaked.
Binance Co-CEO Richard Teng emphasized the sophistication of the intrusion: "To be clear: the attacker did not simply use one engineer's permissions, and this was not a single 'one-click' action. It involved a more complex attack process. Our investigation has not attributed responsibility to any individual."
The exchange acknowledged discovering additional breach vectors while continuing its forensic work. Binance pledged to cover all losses through its SAFU fund and corporate reserves, and committed to publishing an updated Proof of Reserves following remediation efforts.
In response to the incident, Binance halted deposits and withdrawals to conduct security assessments, revoked authorizations tied to the compromised address, and engaged blockchain intelligence partners and law enforcement to pursue asset recovery.
North Korean attribution and record-breaking scale
Blockchain analysis firm TRM Labs attributed the attack to TraderTraitor, a North Korean state-sponsored hacking operation also known as Lazarus Group and APT38. Chainalysis independently corroborated this assessment with high confidence.
TRM Labs documented the theft's scale and speed: "On October 29, 2026, an attacker moved approximately USD 6.36 billion out of Binance wallets on ten blockchains, most of it in about 20 minutes starting at 20:05 UTC. That makes this the largest crypto theft on record, about four times the USD 1.5 billion Bybit hack of February 2025."
Stablecoin issuers and blockchain networks moved quickly to limit the attackers' options. Tether, Circle, Ripple, and World Liberty Financial froze approximately $2.7 billion in stablecoins, while Arbitrum's Security Council froze 8,426 ETH and 74.6 million ARB tokens on its network.
Despite these freezes, the attackers retained control of roughly $2.4 billion in assets beyond the reach of issuers. TRM Labs explained the strategy: "The attacker raced the freezes by selling USDT to market makers and borrowing ETH against USDT on Aave. It now holds more than 420,000 ETH and 18,270 BTC, about USD 2.4 billion in assets beyond any issuer's reach."
TraderTraitor has been linked to multiple major cryptocurrency thefts, including the $1.5 billion Bybit compromise in February 2025. The Binance attack, at $6.36 billion, now ranks as the largest documented cryptocurrency heist.