Press play to start listening
Binance says its investigation into the $6.3 billion cryptocurrency hack and theft has identified several breach points, including a compromised DevOps engineer’s laptop. Blockchain intelligence firms have attributed the hack to North Korean hackers tracked as TraderTraitor, associated with the Lazarus Group.
The October 30 updates provide the first explanation of how attackers reached Binance’s internal systems, alongside a commitment to cover all losses. However, withdrawals remain suspended while the exchange rebuilds security around the affected service.
Hackread.com’s earlier coverage reported outside estimates of up to $5.8 billion in suspicious transfers. Binance has since put the estimated impact at approximately $6.3 billion, making the incident substantially larger than the $1.5 billion Bybit theft in February 2025.
Compromised Laptop Was an Initial Finding
In its first detailed investigation update, Binance said a compromised DevOps engineer’s laptop appeared to have allowed an attacker to access a service container and submit unauthorized withdrawal transactions. A DevOps engineer typically works on the infrastructure and processes used to deploy and operate software.
The attack resembles tactics used by North Korean hackers, who were observed in August 2026 using Ethereum-based dead drops in malicious npm packages to infect developers’ devices.
Binance said it had found no evidence that wallet private keys were leaked. That distinction leaves open the possibility that attackers used access to internal systems to obtain authorized signatures for fraudulent transactions without taking the keys themselves. The exchange said it had revoked the affected address authorization and would publish a technical report after completing its investigation.
However, its later statement made clear that the laptop finding was not the complete explanation. Binance said investigators had identified additional breach points and were still gathering facts about what it described as a complex attack.
The exchange has not explained what those additional points were or how investigators compromised the engineer’s computer. The laptop should therefore be treated as an initial investigative finding, not a settled account of the entire attack.
“A compromised laptop may explain where an attack started, but it does not, on its own, explain how billions of dollars could leave an exchange,” argued Pieter Arntz, researcher at cybersecurity firm Malwarebytes.
“The real question is what allowed that initial foothold to become access to withdrawal systems – and which safeguards failed to stop unauthorized transactions. Until the technical investigation is complete, blaming a single laptop risks confusing the entry point with the full cause of the breach,” Pieter added.
Withdrawals Paused While Deposits Continue
Binance initially announced a precautionary suspension of deposits and withdrawals while it conducted security checks and worked with investigators.
A subsequent service update clarified that deposits were operating normally, while withdrawals remained paused during a security revamp of the withdrawal service and related addresses. Binance initially gave a 48-hour estimate for restoring withdrawals.
Its later announcement said it remained on track to resume the service within 45 hours of that update. That was an expected restoration window, not confirmation that withdrawals had reopened.
Binance Promises to Cover All Losses
Customers will not be required to absorb the losses, according to Binance. The exchange said it would use its Secure Asset Fund for Users, known as SAFU, together with company funds to cover the incident. It also promised an updated Proof of Reserves after remediation.
Binance’s verified announcements reviewed for this report put frozen assets at approximately $3 billion. Freezing restricts further transfers of affected assets, but does not mean the money has already been returned to the exchange.
The North Korea Connection
TRM Labs attributed the attack to TraderTraitor with high confidence, citing blockchain evidence and intelligence obtained outside the blockchain.
The company calculated that approximately $6.36 billion left Binance wallets on ten networks, with most transfers occurring within about 20 minutes from 20.05 GMT on October 29. Its analysis identified preparation beginning at least 36 hours earlier, including funding through Tornado Cash and tests of attack code.
The firm said the combination of valid transactions on different networks pointed to compromised hot-wallet signing infrastructure. On Ethereum, the attacker also used EIP-7702 authorizations to make a Binance wallet execute attacker-controlled code and repeatedly transfer incoming funds.
TRM compared the preparation and signing patterns with earlier North Korea-linked thefts, including Bybit. Chainalysis CEO Jonathan Levin separately assessed that TraderTraitor was likely responsible. These are the firms’ attributions. Binance’s statements reviewed for this article have not named the attackers.
Binance has committed to releasing a full account of the incident. That report will need to explain how access to internal infrastructure translated into unauthorized withdrawals, what the additional breach points involved and which controls have been changed before customers can withdraw again.
