Binance loses ~$6.3B in record crypto heist via compromised DevOps laptop; TRM Labs and Chainalysis blame North Korea's TraderTraitor

Linha do tempo

1. olhardigital.com.br ↗ · pub. 30/10/2026 20:37 · coletado 30/10 21:00

   Binance hot wallets drained of about US$6.3B; TRM Labs and Chainalysis point to North Korea's TraderTraitor, US investigating

   ler a análise desta fonte ocultar

   A cyberattack drained roughly US$6.3 billion in cryptocurrency from hot wallets used by Binance to process transactions, most of it in about 20 minutes from late 29 October 2026. TRM Labs attributed the theft to TraderTraitor, a North Korea-linked unit, with high confidence, and Chainalysis shared that conclusion. Binance has not confirmed the attribution. President Donald Trump said on 30 October that the US government is looking into possible North Korean involvement. The FBI is aware of the incident and Binance is also working with the US Secret Service (per Reuters). Binance says it has set aside about US$6.34 billion of its own funds to cover losses, and that no customer funds were used.

   Technical Details

   • Binance's initial investigation suggests the intrusion may have started with the compromise of a Binance engineer's computer. Other possible entry points were identified later.
   • Co-CEO Richard Teng described the attack as complex. It involved manipulating a system that approves transactions, which let the attackers move funds from an internet-connected wallet without the usual authorization controls.
   • Binance reported that the attackers used software to erase traces and evidence of their activity, which hampers the investigation.
   • The affected assets were hot wallets, which are more exposed than offline cold wallets.
   • Blockchain analytics firms say the incident resembles the Bybit theft of about US$1.5 billion in February 2025, which the FBI attributed to North Korea and TraderTraitor.
   • North Korea routinely denies involvement in cyberattacks. Its representatives in Switzerland and China did not respond to Reuters.

   Remediation

   • Binance temporarily suspended withdrawals and said it expected to resume them within 48 hours.
   • Binance has traced about US$3 billion of the stolen funds with partners. Tether froze about US$1.57 billion and Circle blocked more than US$800 million.
   • The destination of the remaining roughly US$3.3 billion had not been clarified.
   • Market impact: Bitcoin fell to US$76,368, a six-week low, and Ether dropped more than 3% to US$2,178.
2. securityaffairs.com ↗ · pub. 30/10/2026 15:50 · coletado 30/10 17:00

   Binance loses about $6.3B in record crypto theft via compromised DevOps laptop; TRM and Chainalysis attribute it to DPRK's TraderTraitor

   ler a análise desta fonte ocultar

   Binance confirmed a security incident on October 29, 2026, in which an attacker moved roughly $6.36 billion out of Binance wallets across ten blockchains, mostly within about 20 minutes starting at 20:05 UTC. This is the largest crypto theft on record, about four times the $1.5 billion Bybit hack of February 2025. Binance Co-CEO Richard Teng said the incident may have started with a compromised DevOps engineer's laptop, which gave the attacker access to a service container used to submit unauthorized withdrawals. Binance has not named a culprit, but TRM attributes the attack to TraderTraitor (also tracked as Lazarus Group and APT38) with high confidence, and Chainalysis also reports a high degree of confidence in DPRK responsibility. Binance says user funds are safe and that it will cover all losses with its SAFU fund and its own money.

   Technical Details

   • Per Binance, the attacker used access from the engineer's laptop to reach a service container and submit unauthorized withdrawal transactions. Teng stressed this was not a single "one-click" action but a more complex attack process, and that the attacker did not simply use one engineer's permissions.
   • Binance reports no evidence that wallet private keys were stolen. It also said it found "additional points of breach" and is still investigating.
   • Early on-chain estimates varied. Analyst Spreek flagged about $3.55B in incoming transfers to one unlabeled wallet, and Coinbase's Conor Grogan estimated up to $5.8B. These were tracking figures and not confirmed theft totals.
   • Chainalysis observed funds stolen by DPRK in the previous month's Bitget exploit commingling with the funds stolen from Binance.
   • Freezes recovered only part of the funds. Tether, Circle, Ripple and World Liberty Financial froze about $2.67B in stablecoins, and Arbitrum's Security Council froze 8,426 ETH and 74.6M ARB, for roughly $2.7B in all. Early reports put the Tether and Circle freezes at about $1.79B, and these figures describe different moments and should not be added together.
   • The attacker raced the freezes by selling USDT to market makers and borrowing ETH against USDT on Aave. It now holds more than 420,000 ETH and 18,270 BTC, about $2.4B beyond any issuer's reach.

   Remediation

   • Binance suspended deposits and withdrawals for security checks, revoked the permissions tied to the affected address, and is working with blockchain analysis firms and law enforcement. It plans to publish an updated Proof of Reserves after recovery.
   • Customers should use only official Binance channels, avoid unsolicited links, and never share passwords, authentication codes or recovery phrases. Security teams should watch for phishing that exploits the incident.
3. itsecurityguru.org ↗ · pub. 30/10/2026 11:48 · coletado 30/10 12:00

   Binance loses $6.3bn in record crypto heist; TRM Labs attributes to DPRK's TraderTraitor via compromised DevOps laptop

   ler a análise desta fonte ocultar

   Binance confirmed the theft of approximately $6.3 billion in digital assets beginning around 20:05 UTC on 29 October 2026, making it the largest cryptocurrency theft on record — roughly four times the $1.5bn Bybit hack of February 2025. According to TRM Labs, funds drained across ten blockchains including Ethereum, Bitcoin, Tron, XRP Ledger and Solana, with most moved inside 20 minutes. Binance's preliminary findings point to a compromised DevOps engineer's laptop that gave attackers access to a service container able to submit withdrawals; the exchange says there is no evidence of private key leakage but has acknowledged additional points of breach. Around $3 billion was frozen within hours with help from Tether and Circle (over $2.5bn in USDT/USDC), partners and law enforcement, while TRM estimates the attacker still controls over $2.4 billion in ETH and BTC being laundered via Uniswap, Aave and JustLend. TRM attributes the attack "with high confidence" to TraderTraitor, a North Korean state-backed unit linked to Lazarus Group; independent investigator ZachXBT concurs. Bitcoin fell ~5% below $77,000 and BNB dropped ~8%.

   Technical Details

   • Initial access: compromise of a DevOps engineer's endpoint, pivoting to a service container authorised to submit withdrawals — control of the signing/authorisation layer rather than theft of private keys.
   • On Ethereum, the attacker abused EIP-7702 authorisations to make a Binance hot wallet execute an attacker-controlled sweeper contract; the other nine chains saw ordinary signed transfers in the same window.
   • TRM assesses Binance's hot wallet signing infrastructure was likely compromised; no root cause has been published.
   • Pre-attack staging included small Tornado Cash withdrawals funding an operator wallet the day before, plus pre-obtained signatures matching prior DPRK-linked heists.
   • Analysts link the incident to a pattern including Bitget's ~$388m loss in September 2026, also attributed to North Korea and also described as "keys untouched, control layer abused".

   Remediation

   • Treat developer and admin devices as high-value targets; assume any machine or credential is compromised.
   • Enforce independent approval for large transfers; set hard velocity and value limits on fund movement and detect anomalies in seconds.
   • Deploy phishing-resistant MFA, just-in-time privileged access, tightly scoped and monitored human and non-human identities.
   • Inventory exactly which machines and accounts can trigger a transfer, and test whether compensating controls hold when one is compromised.
   • Apply cryptographic separation between systems and tightly controlled paths for sensitive transactions so one foothold does not inherit authority over all assets.
4. techcrunch.com ↗ · pub. 30/10/2026 11:00 · coletado 30/10 12:00

   North Korea's TraderTraitor blamed for record $6.3B crypto theft from Binance via compromised engineer laptop

   ler a análise desta fonte ocultar

   Binance, the world's largest crypto exchange, suffered the largest known cryptocurrency theft in history, with at least $6.3 billion drained from its wallets. Binance stated its initial investigation traced the intrusion to a compromised engineer's laptop, which allowed the attacker to access a service container and submit unauthorized withdrawal transactions. The exchange said there is no evidence its private keys were leaked, and it has suspended all deposits and withdrawals pending investigation. TRM Labs and Elliptic both attributed the heist to North Korean state-linked hackers tracked as TraderTraitor, the same cell blamed for the $1.4B Bybit hack in 2025. Roughly $3 billion has been frozen by industry partners, according to Binance spokesperson Andie Cooper.

   Technical Details

   • Initial access: compromise of a Binance engineer's laptop; the circumstances remain unclear, with TechCrunch noting compromised software/open-source components and malware-bundled apps stealing credentials and session tokens as common vectors.
   • Lateral movement into a service container with authority to submit withdrawal transactions.
   • TRM Labs reports the drain took roughly 20 minutes and calls it the "largest hack in history."
   • Elliptic says some stolen funds landed in the same wallet used in the $351 million Bitget theft earlier this year, reinforcing attribution.

   Remediation

   • Binance suspended all deposits and withdrawals and says it has begun recovering affected assets, working with law enforcement, token issuers and blockchain intelligence firms to trace and freeze funds.
   • Binance pledged to publish an updated proof of reserves once remediation completes; it has not yet provided proof that user funds are safe.
   • Defenders should review segregation between employee endpoints and production signing/withdrawal infrastructure, enforce multi-party approval for high-value transactions, and monitor developer workstations for infostealer and supply-chain compromise.
5. olhardigital.com.br ↗ · pub. 30/10/2026 08:20 · coletado 30/10 10:01

   Binance loses $6.3B in largest crypto exchange hack ever; TRM Labs links theft to North Korean actors

   ler a análise desta fonte ocultar

   Hackers stole approximately $6.3 billion from Binance, the world's largest cryptocurrency exchange, in what analysts describe as the largest theft in the sector's history. According to TRM Labs, the attackers drained Binance wallets across 10 different blockchains, moving most of the funds in roughly 20 minutes, and the firm attributed the operation to North Korean groups based on technical similarities with prior thefts including the 2025 Bybit hack. Chainalysis could not yet confirm the root cause but had traced at least $5.912 billion in stolen assets. Binance's preliminary investigation indicates the intrusion may have begun with the compromise of an engineer's computer, granting the attacker access to an internal system used to perform unauthorized withdrawals. Binance says user deposits were unaffected, withdrawals were expected to resume within 48 hours, and co-founder Yi He stated the company will cover all losses.

   Technical Details

   • Wallets drained across 10 blockchains, with the bulk of funds moved in ~20 minutes.
   • Initial access hypothesis: compromise of an engineer's workstation leading to access to a Binance internal system (T1078, T1199 style trusted-access abuse).
   • Mark Karpeles (ex-Mt. Gox) suggested the attacker may have obtained valid authorization to move funds and possibly access to a private key.
   • Attribution to DPRK-linked actors by TRM Labs, echoing the FBI's attribution of the 2025 Bybit theft.

   Remediation

   • Binance worked with partners to freeze roughly $3 billion: Tether froze ~$1.57B, Circle blocked >$800M, Ripple froze ~$200M, and World Liberty Financial with custodian BitGo froze $27M in stablecoins and ~$2M in its tokens.
   • Binance maintains a Bitcoin-denominated customer protection fund (SAFU-style) to absorb losses.
   • Market impact: Bitcoin fell >3% to a six-week low of $76,368, Ether fell >3% to $2,178, Coinbase shares dropped 4.8% and Strategy nearly 6%.
6. infosecurity-magazine.com ↗ · pub. 30/10/2026 08:25 · coletado 30/10 10:01

   Binance confirms record $6.3bn crypto theft attributed to North Korea's TraderTraitor

   ler a análise desta fonte ocultar

   Binance has confirmed the largest cryptocurrency heist on record, with $6.3bn in crypto stolen. In an October 30 statement, the exchange said the likely entry point was a compromised DevOps engineer's laptop, which gave the attacker access to a service container and allowed submission of unauthorized withdrawal transactions; subsequent investigation uncovered additional points of breach. Binance says it has frozen $3bn of the stolen funds and will cover all losses via its SAFU fund and company funds, and found no evidence that wallet private keys were leaked. TRM Labs, Elliptic and Chainalysis attribute the attack with high confidence to TraderTraitor, a North Korean threat group. Withdrawals remain suspended pending a security revamp, with resumption expected within 45 hours; deposits have resumed.

   Technical Details

   • Initial access suspected via a compromised DevOps engineer endpoint, pivoting to a service container used to sign/submit withdrawal transactions.
   • Binance states multiple breach points were later identified and describes the intrusion as a complex attack; a full technical post-mortem is pending.
   • Unauthorized outflows stopped once withdrawals were paused; the affected address authorization was revoked.

   Remediation

   • Temporary suspension of withdrawals and Binance Alpha trading activities; deposits restored.
   • Security revamp of the withdrawal service and related addresses, updated proof of reserves to follow.
   • Users warned of scams and phishing exploiting the incident: trust only official Binance channels and never share account information.
7. wired.com ↗ · pub. 30/10/2026 08:36 · coletado 30/10 10:01

   $6.3B Binance hot wallet heist executed in 20 minutes, tracing firms point to North Korea's TraderTraitor

   ler a análise desta fonte ocultar

   Binance lost roughly $6.3 billion in cryptocurrency on October 29, 2026, with the bulk drained in about 20 minutes from hot wallets spanning at least ten blockchains including Ethereum, Bitcoin, Tron and Solana. Binance suspended deposits and withdrawals, pledged to cover all losses, and said its investigation initially pointed to a compromised engineer's laptop but has since uncovered "additional points of breach." Tracing firms TRM Labs, Chainalysis and Elliptic assess North Korean involvement, with TRM and Chainalysis specifically linking the operation to TraderTraitor, the group the FBI blamed for the $1.5 billion Bybit heist. Chainalysis investigators observed stolen funds commingling in real time with proceeds of the earlier Bitget exploit attributed to DPRK actors. Around $2.8 billion (44%), almost all stablecoins, has been frozen; the remaining ~$3.3 billion in Bitcoin, Ether and XRP cannot be frozen.

   Technical Details

   • Preparation began at least 36 hours before the theft (TRM Labs). The operator funded a wallet via Tornado Cash and received three small test withdrawals.
   • Early on October 29 the attacker deployed a first version of the attack code and tested it on two wallets, then rehearsed the final version on a third wallet and routed test funds back to itself.
   • Four hours after the rehearsal the same code was installed on a Binance hot wallet, draining funds to multiple addresses controlled by a single attacker.
   • Chainalysis reports laundering patterns not previously seen, with thousands of rapid transactions indicating automation used to obscure the fund trail.
   • Targeting crypto staff with social engineering and bespoke fake applications is described as a TraderTraitor hallmark (Elliptic, Sophos).

   Remediation

   Crypto exchanges and custodians should coordinate freezing of flagged stablecoin addresses, monitor for inbound laundered funds, and harden developer and engineer endpoints against laptop compromise, including strict separation between workstation access and hot wallet signing infrastructure.

8. digit.fyi ↗ · pub. 30/10/2026 08:16 · coletado 30/10 10:00

   Binance reports $6.3B crypto theft attributed to North Korea's TraderTraitor

   ler a análise desta fonte ocultar

   Binance disclosed a cyberattack affecting approximately $6.3 billion in digital assets, potentially the largest cryptocurrency hack on record. The exchange says roughly half the affected assets have been frozen with help from other platforms and pledged to cover all losses. Initial investigation points to a compromised laptop belonging to a Binance engineer as the entry point, enabling unauthorised withdrawals. Blockchain analytics firms TRM Labs and Chainalysis both attribute the intrusion to TraderTraitor, a North Korean group also linked to the 2025 Bybit hack ($1.5bn). Binance has not confirmed the DPRK attribution and says it is cooperating with law enforcement; Binance.US is unaffected.

   Technical Details

   • Suspected initial access via an engineer's compromised endpoint, consistent with TraderTraitor's history of social engineering and developer/employee targeting.
   • Attack elements resemble prior DPRK-linked exchange intrusions, notably Bybit (2025).
   • The attacker reportedly still controls a substantial portion of the stolen assets; tracing and recovery are ongoing.

   Remediation

   • Exchanges should harden privileged engineer workstations, enforce hardware-backed MFA, segment signing infrastructure and apply multi-party approval for withdrawals.
   • Monitor for anomalous withdrawal flows and coordinate with analytics providers for asset freezing.
9. bleepingcomputer.com ↗ · pub. 30/10/2026 06:18 · coletado 30/10 07:00

   Binance traces record $6.3B crypto theft to compromised DevOps engineer laptop; TraderTraitor blamed

   ler a análise desta fonte ocultar

   Binance has attributed the theft of roughly $6.3 billion in cryptocurrency to a compromised DevOps engineer's laptop, which attackers used to reach a service container and submit unauthorized withdrawal transactions. Co-CEO Richard Teng stressed the intrusion was not a single "one-click" action and that no leaked wallet private key has been found; the company says it "uncovered additional points of breach" and is still investigating. Blockchain intelligence firms TRM Labs and Chainalysis attribute the attack with high confidence to TraderTraitor, the North Korean state-backed unit also tracked as Lazarus Group and APT38. Roughly $2.7 billion has been frozen by Tether, Circle, Ripple, World Liberty Financial and Arbitrum's Security Council, but about $2.4 billion in ETH and BTC remains beyond issuer control. At $6.36 billion, this surpasses the February 2025 Bybit hack as the largest crypto theft on record.

   Technical Details

   Access to a DevOps engineer's endpoint enabled lateral movement into a service container from which unauthorized withdrawals were submitted. On 29 October 2026, approximately USD 6.36 billion moved out of Binance wallets across ten blockchains, most of it within about 20 minutes starting at 20:05 UTC. The attacker outran freezing actions by selling USDT to market makers and borrowing ETH against USDT on Aave, ending with over 420,000 ETH and 18,270 BTC.

   Remediation

   Binance suspended deposits and withdrawals pending security checks, revoked authorizations for the affected address, and is working with blockchain intelligence partners and law enforcement on tracing and recovery. Losses will be covered by the SAFU fund and company funds, with an updated Proof of Reserves to be published after remediation.

10. securityweek.com ↗ · pub. 30/10/2026 05:16 · coletado 30/10 06:00

    $6.3 Billion Binance Heist Attributed to North Korea's TraderTraitor After DevOps Laptop Compromise

    ler a análise desta fonte ocultar

    Binance suffered the largest crypto theft ever recorded, losing roughly $6.3 billion (TRM Labs counts $6.36B) across ten blockchains on October 29, 2026, with most funds moved within about 20 minutes. Binance's initial investigation points to a compromised DevOps engineer's laptop that gave the attacker access to a service container capable of submitting unauthorized withdrawal transactions; no wallet private key leak was found. TRM Labs attributes the attack with high confidence to TraderTraitor, North Korea's elite hacking unit, citing overlaps with the Bybit ($1.5B, Feb 2025) and KelpDAO (April 2026) heists. Chainalysis concurs, noting proceeds from the Bitget exploit mixed with Binance funds, and ZachXBT points to Lazarus Group. Roughly $2.7–3 billion has been frozen by Tether, Circle, Ripple, World Liberty Financial and Arbitrum's Security Council, but over 420,000 ETH and 18,270 BTC (~$2.4B) remain unfreezable.

    Technical Details

    • The operator wallet was funded via small Tornado Cash withdrawals; malicious code was trialed on other wallets at least a day and a half in advance.
    • On Ethereum, attackers abused EIP-7702 delegation, submitting a batch of 50 pre-signed permissions from a Binance hot wallet so one would match the wallet's nonce at execution, delegating the wallet to an attacker-controlled contract.
    • On the other nine chains, funds moved via regular, validly signed transactions across different key types and signing schemes within ~30 minutes, leading TRM to assess the attacker gained the ability to make Binance's hot wallet signing system sign arbitrary transactions.
    • Laundering differed from Bybit: instead of cross-chain bridges, attackers used large trades with market makers and lending platforms, dumping USDT for ETH at >10% below market to outrun issuer freezes.

    Remediation

    Binance halted withdrawals and pledged full reimbursement via company funds and the Secure Asset Fund for Users (SAFU). Exchanges should review endpoint hardening for DevOps staff, isolate signing infrastructure from developer workstations, enforce transaction policy controls on hot wallet signers, and monitor for anomalous EIP-7702 delegations.

11. gbhackers.com ↗ · pub. 30/10/2026 03:18 · coletado 30/10 04:00

    Binance halts deposits and withdrawals after breach; estimates of stolen crypto range from $5.7B to $6.3B

    ler a análise desta fonte ocultar

    Binance suspended all deposits and withdrawals following a security incident in which attackers allegedly drained billions in cryptocurrency from internet-connected hot wallets. Early blockchain-tracking estimates put losses at roughly $5.7 billion, with later figures of about $5.9 billion cited by Chainalysis and around $6.3 billion attributed to Binance itself. The exchange stated that user funds remain safe, that it will cover all losses, and that it is working with law enforcement while preparing a full postmortem. Preliminary findings point to a compromised DevOps engineer's laptop that allowed an attacker to reach a service container and submit unauthorized withdrawal transactions, though no completed forensic determination has been published. Frozen assets have risen from $2.54 billion to roughly $3 billion, aided by Tether (over $1.57 billion USDT) and Circle (around $800 million USDC).

    Technical Details

    Binance's preliminary account describes endpoint compromise of a DevOps engineer leading to access to a service container and unauthorized withdrawal submissions from hot wallets. The initial infection method, exploited vulnerability, persistence mechanism and credentials involved have not been disclosed; the article explicitly notes it is unknown whether phishing, malware or another technique was used. Comparisons to the Bybit exchange theft have been made, but no shared attacker or identical exploitation method has been established.

    Remediation

    Binance advises users to rely exclusively on official channels and to ignore unofficial links, messages or requests for account information, as scam activity typically follows such incidents. Deposits and withdrawals remain suspended as a precaution while security checks and asset freezes proceed.

12. thehackernews.com ↗ · pub. 30/10/2026 01:14 · coletado 30/10 03:00 primeiro registro

    Binance breach impacts $6.3B in assets; compromised DevOps engineer laptop enabled unauthorized withdrawals

    ler a análise desta fonte ocultar

    Binance disclosed a "security incident" affecting approximately $6.3 billion in assets, with nearly $3 billion frozen on-chain so far. Initial investigation points to a compromised DevOps engineer's laptop, which gave the attacker access to a service container from which unauthorized withdrawal transactions were submitted; Binance says there is no evidence of wallet private key leakage. Tether froze over 1.567 billion USDT, Circle froze 800 million, and the Arbitrum Security Council froze about $30.5 million tied to the exploit. Chainalysis estimates roughly $5.912 billion stolen at the time of theft, nearly 4x the Bybit February 2025 heist (~$1.5B, attributed to North Korea), making it the largest crypto heist on record. Binance will cover losses via its SAFU fund and its own reserves. Story is still developing.

    Technical Details

    • Initial access attributed to a compromised endpoint (DevOps engineer's laptop).
    • Lateral movement into a service container with privileges to submit withdrawal transactions.
    • No private key compromise claimed; abuse of authorized infrastructure paths instead.

    Remediation

    • Binance temporarily suspended deposits and withdrawals pending security checks.
    • Revoked the affected address authorization.
    • Engaged law enforcement and blockchain intelligence partners to trace and recover funds.
    • Stablecoin issuers executed on-chain freezes of attacker-controlled funds.