Compromised laptop could be to blame for record $6.3 billion cryptocurrency heist: Binance rushes to freeze stolen assets as experts blame North Korean group
Maybe I've been too harsh on those mandatory cybersecurity training courses that my company keeps reminding me to do. What looks to be the largest ever cryptocurrency heist may have started with an engineer's compromised laptop, and the attacker got away with more than a couple coins: $6.3 billion in stolen cryptocurre...
Maybe I've been too harsh on those mandatory cybersecurity training courses that my company keeps reminding me to do. What looks to be the largest ever cryptocurrency heist may have started with an engineer's compromised laptop, and the attacker got away with more than a couple coins: $6.3 billion in stolen cryptocurrency.
The victim is Binance, by far the largest cryptocurrency exchange in the world. The hacker made off with tremendous sums of a range of cryptocurrencies, including ethereum, bitcoin, solana, and XRP. The total sums amount to around $6.3 billion worth.
Binance says it has worked with blockchain partners to freeze roughly $3 billion worth of that, leaving $3.3 billion still unaccounted for.
Binance founder Changpeng Zhao took to X to suggest that he feels all user funds would be fully covered. Zhao is no longer running Binance following a four-month stint in prison for violating anti-money-laundering laws. He was later pardoned by president Donald Trump. Binance has since confirmed that, yes, it will cover all losses.
"Binance's initial investigation suggests that the security incident may involve a compromised DevOps engineerâs laptop," the company says on X, "which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions."
Binance says it's still figuring out what actually happened here, though experts are already chiming in with what might have gone down.
Binance's initial investigation suggests that the security incident may involve a compromised DevOps engineerâs laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions. We have found no evidence of any wallet private key leak. We will share a detailed technical post-mortem once the investigation is complete and the facts are fully verified.The estimated total impact sits at around $6.3B. We have worked with blockchain partners to freeze affected assets, with ~$3 billion frozen on-chain so far.Binance will cover all losses from the SAFU fund and the companyâs funds. User funds are safe. We will also publish an updated Proof of Reserves once the remediation is complete.As an immediate precaution, Binance has:- temporarily suspended deposits and withdrawals while security checks are completed;- revoked the affected address authorisation;- engaged law enforcement and blockchain intelligence partners to trace and recover funds.Our teams are working around the clock to resolve this issue safely and thoroughly. We are working closely with our law enforcement partners to confirm the identity of these criminals and bring them to justice.Please rely only on official Binance channels for updates. Please feel free to contact Binance Customer Support if you have any further questions.https://t.co/ywB2mKFy0pOctober 30, 2026
"The attackers didn't break the encryption or steal the private keys. They took over the system that tells the keys what to sign," Jayant Dave from Check Point tells BBC News.
Also speaking to BBC News, Emily Taylor, co-founder of the Global Signal Exchange, said the hack was conducted "on a speed and scale we've never seen."
Blockchain intelligence firm TRM says that the theft may have come down to misuse of what's known as a hot wallet, "a wallet connected to the internet that an exchange uses to process customer withdrawals". Early reports suggested someone had phished the authorisations required to access one of Binance's main Ethereum hot wallets, but later reports of further thefts from other cryptocurrency wallets with different chains, keys, and signing schemes suggest the attacker may have had deeper access to Binance.
"The most likely explanation is that the attacker gained the ability to make Binance's hot wallet signing system sign transactions of its choosing across chains," TRM says.
"In this incident, a single actor obtained valid signatures for wallets on ten chains within hours."
Tether froze more than 1.567B USDT related to a potential Binance exchange hack. Protecting the industry and our partners is our main priority.Stay safe everyone.October 29, 2026
So whodunit? TRM points a finger at North Korean hacking group TraderTraitor, a state-sponsored group said to be behind the $1.5 billion Bybit hack in February, 2025.
Binance says it is working with law enforcement to confirm the identity of the hackers. It hasn't given any official indication as to their identity as of yet.
There are sure to be a few reckonings for the cryptocurrency market out of this. Firstly, how could a single compromised laptop issue $6.3 billion worth of dodgy signatures? Secondly, if cryptocurrency is so decentralised, how come a few key players freeze billions in assets when required? Thirdly, how many large-scale heists have to take place before trust in the system falls through the floor?
Original reporting appears on the publisher’s site.
Open original article →
