Binance Hack: A Compromised DevOps Laptop, a $6.3 Billion Theft the FBI Ties to North Korea, and What to Lock Down This Week
Binance says the $6.3 billion theft on October 29 may have started on one DevOps engineer's compromised laptop, and the FBI blames North Korea's TraderTraitor. Here is what is confirmed and what businesses should lock down.
Where Worldwide
On this page 8 sections
Binance, the world's largest cryptocurrency exchange, lost roughly $6.3 billion in about 20 minutes on October 29, 2026. Its early finding is that the attack may have started on one DevOps engineer's compromised laptop. If anyone in your business has a laptop that can reach your servers, cloud accounts, website hosting or payment systems, that laptop is a way in for attackers, and this is the biggest proof of it so far.
The FBI has publicly blamed North Korea. How the laptop was compromised, and how much else the attackers got into, is still not public. This post separates what is confirmed from what is only claimed, then gives you a checklist for this week.
What happened in the Binance hack
- Thursday, October 29, 2026, from 20:05 UTC: funds started leaving Binance hot wallets on ten blockchains. Most of the money was gone within about 20 minutes, according to blockchain analysis firm TRM Labs. A second wave hit Avalanche and Polygon around 23:05 UTC.
- The same night: Binance suspended deposits and withdrawals. It said it would cover the losses from its SAFU emergency fund and company funds, and that user funds are safe.
- Saturday, October 31, 2026: the FBI published an alert saying North Korea "was responsible for the theft of more than $6 billion" from Binance. It named the activity TraderTraitor and asked exchanges and other crypto services to block transactions involving the laundering addresses.
TRM calls it the largest crypto theft on record, about four times the $1.5 billion Bybit hack of February 2025.
What is confirmed, and what is only claimed
| Statement | Who says it | Status |
|---|---|---|
| About $6.3 billion was taken | Binance; TRM puts it at $6.36 billion at transfer-time prices; the FBI says "more than $6 billion" | Confirmed as a range. The exact figure depends on which prices you use |
| North Korea's TraderTraitor did it | FBI alert, TRM Labs, Chainalysis | Confirmed by the FBI |
| It started with a compromised DevOps laptop | Binance's initial investigation, in a statement to reporters | Claimed and preliminary. Binance has not published a root cause |
| The laptop gave access to a service container used to submit withdrawals | Binance | Claimed |
| No wallet private key leaked | Binance | Claimed. TRM's view is that the attacker probably got Binance's hot wallet signing system to sign transactions |
| About $2.7 billion was frozen | TRM, from on-chain data as of 00:30 UTC on October 30 | Confirmed on-chain by TRM |
| How the laptop was compromised | Nobody has said | Not known |
One caution: the laptop is not the whole story. BleepingComputer reports that Binance co-CEO Richard Teng said the attacker "did not simply use one engineer's permissions", and that Binance later said it had "uncovered additional points of breach." Binance has not blamed any one person. Read "one laptop" as where the investigation starts, not a final answer.
How a DevOps laptop turns into a $6 billion problem
DevOps engineers keep the systems running. Their laptops usually hold the keys to everything: SSH keys, cloud credentials, deployment tokens and access to containers. Binance's own wording is that the compromise "allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions." In other words, Binance's systems trusted requests that came from inside.
TRM's timeline shows how patient the attackers were. They funded an operator wallet from October 28. Early on October 29 they tested their attack code on two wallets, then rehearsed the final version on a third. About four hours later the same code was running on a Binance hot wallet. On Ethereum, 50 authorizations signed in advance were used together in one burst. None of this is a smash-and-grab. The attackers studied the systems first, and the laptop is what let them in.
How TraderTraitor targets developers and IT staff
TraderTraitor is not a new name. In April 2022, CISA, the FBI and the Treasury Department published advisory AA22-108A about this group. It says the group targets employees at crypto companies who work in system administration or DevOps. Its usual approach is to pose as recruiters offering well-paid jobs, then get the target to download a trojanized app for Windows or macOS built with JavaScript, Node.js and Electron.
Nobody has confirmed that this is how the Binance laptop was compromised. But it shows what these attackers aim for: the people with admin access, reached through their own laptops. Fake tools and poisoned packages show up again and again, as in the fake ChatGPT and Claude installers, the backdoored Claude Code extension and malicious npm packages, which a package firewall can block.
Why it matters if you are not a crypto exchange
Most businesses do not hold billions in crypto. But your web developer, your IT admin and your outside contractor all have laptops that can reach things that matter: your hosting control panel, your cloud account, your code, your password manager, your customer database. If one of those laptops is compromised, attackers can change your website, steal customer data or reroute payments without ever touching your firewall.
We have seen this before at a smaller scale. When Northflank customer AI API keys were misused, the damage came from stolen credentials, not a broken server. A private network is only as safe as its weakest device. Binance shows what that looks like when the stakes are very high.
What to do this week: developer and admin laptop checklist
| Action | How to check |
|---|---|
| List everyone with admin or production access | Include staff, contractors and agencies. Check your cloud, hosting, domain registrar, code hosting and payment accounts |
| Require phishing-resistant MFA | Passkeys or hardware security keys on cloud consoles, code hosting, hosting panels and password managers. Text-message codes are the weakest option |
| Get long-lived secrets off laptops | Look for ~/.aws/credentials, unprotected SSH keys, .env files and kubeconfig files. Move them to a secrets vault or short-lived credentials |
| Put endpoint protection on every admin laptop | Someone should actually watch the alerts. Contractors' machines count too |
| Separate admin work from everyday work | Use a separate browser profile, account or device for production access, not the one used for email and downloads |
| Require two people for high-risk actions | Large payments, production deploys, DNS changes and new admin accounts need a second approver |
| Set a rule for recruiter messages | Never run "test projects" or apps from job offers on a work machine |
| Install software only from the vendor | Use application allowlisting where you can |
| Alert on unusual activity | New API keys, logins from new places, large outbound transfers |
If you hold funds at Binance, check its official channels for withdrawal status. Ignore any message offering a "refund" or "recovery", because scammers follow big hacks.
Binance hack questions people are asking
How much was stolen in the Binance hack?
Binance says about $6.3 billion. TRM Labs puts it at $6.36 billion at the prices when the money moved. The FBI says "more than $6 billion."
Who hacked Binance?
The FBI says North Korea did it and calls the activity TraderTraitor, a group also tracked as Lazarus Group and APT38. TRM Labs and Chainalysis say the same.
Was the Binance hack caused by one laptop?
Binance's initial investigation points to a compromised DevOps engineer's laptop. But Binance also says it found additional points of breach, and its co-CEO said this was not just one engineer's permissions. The full root cause is not public.
Were Binance private keys stolen?
Binance says it has found no evidence of a wallet private key leak. TRM thinks the attacker probably got Binance's signing system to approve the transactions.
Are Binance users' funds safe?
Binance says user funds are safe and that it will cover the losses from its SAFU fund and company funds. Check Binance's official channels for the latest on withdrawals.
What is TraderTraitor?
A North Korean state-backed hacking unit that targets crypto companies. A 2022 CISA advisory describes it targeting DevOps and system admin staff with fake job offers and trojanized apps.
What should my business do?
Find out whose laptops can reach your important systems. Then require phishing-resistant MFA, move secrets off those laptops, put endpoint protection on them, and require two people to approve high-risk actions.
The bigger lesson
Attackers no longer need to break through your servers if they can log in from a laptop your servers already trust. Protecting the people who hold admin access, and limiting what one compromised machine can do, is now as important as patching.
Want a review of who and what can reach your systems? See security hardening or get a quote.
Get security alerts by email, along with our free checklist, at /security-alerts.
Sources: FBI: North Korea Responsible for $6 Billion+ Binance Attack; TRM Labs: North Korea steals USD 6.36 billion from Binance; CISA advisory AA22-108A: TraderTraitor; BleepingComputer: Binance links $6.3 billion theft to compromised DevOps laptop.
Have a question about this article?
Ask it here and we will answer you directly by email. Questions are private, never posted.
Security alerts by email
Hear about the next one first.
When attackers start using a flaw in software businesses run on, we email what it is, whether it touches you and what to do that week, with a round-up of our latest security writing. Free, one-click unsubscribe. You get the checklist straight away: 12 things to secure this week.
Want a result like this?
Security alerts, breaches and the technology a business runs on: what happened, who it affects and what to do.
Get a Tech QuoteKeep reading
Moldova Cyberattack: State Actor Suspected After Citizen Data Was Taken From Government Systems, What Is Confirmed and What to Check
Moldova says hackers accessed the personal data of about 450,000 citizens through government digital services....
Park Dental Data Breach Settlement: Up to $2,500 for Patients, a December 28 Claim Deadline, and Why the Case Is Still Not Over
Park Dental patients have until December 28, 2026 to claim up to $2,500 or $60, plus credit monitoring, over a...
Rosstat Cyberattack: Russia's Statistics Agency Is Still Restoring Systems, What Is Confirmed and What Businesses Should Check
Rosstat says it is still restoring systems after cyberattacks from October 29 to November 1, 2026. Hackers cla...
