Binance probes compromised DevOps laptop after $6.3B theft attributed to North Korea's TraderTraitor
Binance says its investigation into a roughly $6.3 billion cryptocurrency theft found a compromised DevOps engineer's laptop that let an attacker reach a service container and submit unauthorized withdrawals. Blockchain intelligence firms TRM Labs and Chainalysis attribute the theft to the North Korean group TraderTraitor (linked to Lazarus Group). Binance has stated that the laptop is only an initial finding and that additional breach points exist. Withdrawals remain paused while deposits continue, and the exchange has promised to cover all losses via its SAFU fund.
Detalhes técnicos
- Binance found no evidence that wallet private keys leaked; it revoked the affected address authorization. This leaves open that attackers abused internal access to obtain valid signatures.
- TRM Labs calculated about $6.36B left Binance wallets across ten networks, mostly within about 20 minutes starting 20:05 GMT on October 29.
- Preparation began at least 36 hours earlier, including funding through Tornado Cash and tests of attack code.
- Valid transactions across many networks pointed to compromised hot-wallet signing infrastructure.
- On Ethereum, the attacker used EIP-7702 authorizations to make a Binance wallet execute attacker-controlled code and repeatedly forward incoming funds.
- TRM compared preparation and signing patterns to earlier DPRK thefts including Bybit ($1.5B, Feb 2025). The article notes the tactic resembles North Korean use of Ethereum-based dead drops in malicious npm packages seen in August 2026.
- Binance has not named the attackers; attribution is from TRM (high confidence) and Chainalysis (likely).
- About $3B in assets has been frozen by industry partners.
Remediação
- Binance is revamping the withdrawal service and related addresses and expects to resume withdrawals within about 45 hours of its update.
- A technical post-mortem and an updated Proof of Reserves are promised.
- Malwarebytes' Pieter Arntz cautions against treating the laptop as the full cause; the question is why safeguards failed to stop unauthorized transactions.
Linha do tempo
-
Binance probes compromised DevOps laptop after $6.3B theft attributed to North Korea's TraderTraitor
ler a análise desta fonte ocultar
Binance says its investigation into a roughly $6.3 billion cryptocurrency theft found a compromised DevOps engineer's laptop that let an attacker reach a service container and submit unauthorized withdrawals. Blockchain intelligence firms TRM Labs and Chainalysis attribute the theft to the North Korean group TraderTraitor (linked to Lazarus Group). Binance has stated that the laptop is only an initial finding and that additional breach points exist. Withdrawals remain paused while deposits continue, and the exchange has promised to cover all losses via its SAFU fund.
Technical Details
- Binance found no evidence that wallet private keys leaked; it revoked the affected address authorization. This leaves open that attackers abused internal access to obtain valid signatures.
- TRM Labs calculated about $6.36B left Binance wallets across ten networks, mostly within about 20 minutes starting 20:05 GMT on October 29.
- Preparation began at least 36 hours earlier, including funding through Tornado Cash and tests of attack code.
- Valid transactions across many networks pointed to compromised hot-wallet signing infrastructure.
- On Ethereum, the attacker used EIP-7702 authorizations to make a Binance wallet execute attacker-controlled code and repeatedly forward incoming funds.
- TRM compared preparation and signing patterns to earlier DPRK thefts including Bybit ($1.5B, Feb 2025). The article notes the tactic resembles North Korean use of Ethereum-based dead drops in malicious npm packages seen in August 2026.
- Binance has not named the attackers; attribution is from TRM (high confidence) and Chainalysis (likely).
- About $3B in assets has been frozen by industry partners.
Remediation
- Binance is revamping the withdrawal service and related addresses and expects to resume withdrawals within about 45 hours of its update.
- A technical post-mortem and an updated Proof of Reserves are promised.
- Malwarebytes' Pieter Arntz cautions against treating the laptop as the full cause; the question is why safeguards failed to stop unauthorized transactions.