Binance $6.3B theft traced to compromised DevOps engineer laptop, additional breach points found
Binance reports a roughly $6.3 billion incident that its initial findings link to a compromised DevOps engineer's laptop, which allegedly gave an attacker access to a service container able to submit unauthorized withdrawal transactions. A later investigation update said further work uncovered additional points of breach beyond the laptop, without detail. Binance says about $3 billion has been frozen on-chain, that it will cover all losses, and that it has so far found no evidence of a wallet private key leak. Co-CEO Richard Teng stated the attack went beyond one engineer's permissions and more than a single click. TRM Labs and Chainalysis attribute the incident to TraderTraitor, a North Korean unit; Binance has not confirmed the attribution.
Detalhes técnicos
The article, from Aikido, describes the plausible chain rather than confirmed Binance forensics: malicious code on a developer device harvests cloud credentials, SSH and git keys, Kubernetes configs and live session tokens that bypass MFA, then the attacker pivots to internal build servers or cloud accounts and finally to a service authorized to submit withdrawals. Because signing keys typically sit in a vault or HSM and an approval service requests signatures, funds can move without key theft — a view also voiced by Blockaid's CEO (compromise of signing infrastructure). Aikido notes it blocked nearly 500 malware attacks on developer devices in one week, and cites North Korean developer-targeting techniques: fake job interviews with take-home coding tests, malicious npm install scripts, and malicious IDE extensions. Prior examples cited include the npm package react-html2pdf.js (March 2025, attributed to Lazarus Group), the PolinRider campaign hiding obfuscated code in project config files that runs on opening a project in VS Code and rewrites repository history, and the 2025 Bybit theft where a developer laptop was compromised on Feb 4 and a stolen AWS session token enabled malicious code injection on Feb 17 leading to the Feb 21 theft (per Safe findings reported by heise).
Remediação
- Deploy endpoint controls that block malicious packages, editor extensions and AI tools before installation; quarantine packages published in the last 48 hours.
- Keep long-lived credentials off developer disks; issue short-lived, hours-scoped credentials.
- Require out-of-band approval for high-value actions such as withdrawals so a compromised service cannot self-approve.
- Alert on credential and session use from anomalous locations or times.
- Bring contractor and personal machines that reach production under company management.
Linha do tempo
-
Binance $6.3B theft traced to compromised DevOps engineer laptop, additional breach points found
ler a análise desta fonte ocultar
Binance reports a roughly $6.3 billion incident that its initial findings link to a compromised DevOps engineer's laptop, which allegedly gave an attacker access to a service container able to submit unauthorized withdrawal transactions. A later investigation update said further work uncovered additional points of breach beyond the laptop, without detail. Binance says about $3 billion has been frozen on-chain, that it will cover all losses, and that it has so far found no evidence of a wallet private key leak. Co-CEO Richard Teng stated the attack went beyond one engineer's permissions and more than a single click. TRM Labs and Chainalysis attribute the incident to TraderTraitor, a North Korean unit; Binance has not confirmed the attribution.
Technical Details
The article, from Aikido, describes the plausible chain rather than confirmed Binance forensics: malicious code on a developer device harvests cloud credentials, SSH and git keys, Kubernetes configs and live session tokens that bypass MFA, then the attacker pivots to internal build servers or cloud accounts and finally to a service authorized to submit withdrawals. Because signing keys typically sit in a vault or HSM and an approval service requests signatures, funds can move without key theft — a view also voiced by Blockaid's CEO (compromise of signing infrastructure). Aikido notes it blocked nearly 500 malware attacks on developer devices in one week, and cites North Korean developer-targeting techniques: fake job interviews with take-home coding tests, malicious npm install scripts, and malicious IDE extensions. Prior examples cited include the npm package react-html2pdf.js (March 2025, attributed to Lazarus Group), the PolinRider campaign hiding obfuscated code in project config files that runs on opening a project in VS Code and rewrites repository history, and the 2025 Bybit theft where a developer laptop was compromised on Feb 4 and a stolen AWS session token enabled malicious code injection on Feb 17 leading to the Feb 21 theft (per Safe findings reported by heise).
Remediation
- Deploy endpoint controls that block malicious packages, editor extensions and AI tools before installation; quarantine packages published in the last 48 hours.
- Keep long-lived credentials off developer disks; issue short-lived, hours-scoped credentials.
- Require out-of-band approval for high-value actions such as withdrawals so a compromised service cannot self-approve.
- Alert on credential and session use from anomalous locations or times.
- Bring contractor and personal machines that reach production under company management.