Binance first traced its $6.3 billion crypto theft to one engineer’s hacked laptop

Binance’s first explanation for the largest cryptocurrency theft on record pointed to a single place: a compromised laptop used by one of its DevOps engineers. Binance says the incident affected about $6.3 billion in assets, and the analytics firm TRM Labs counts $6.36 billion leaving the exchange’s wallets across ten blockchains, most of it within roughly 20 minutes starting at 20:05 UTC on October 29. Within a day, the company’s own account had grown more complicated.

Tech news in one quick read: Get the most interesting stories in startups, tech and programming, each with a short TLDR, in one daily email from TLDR.

Subscribe to TLDR →

We may earn a commission if you sign up.

Binance’s initial update said the laptop may have given an attacker access to a service container, which was then used to submit unauthorized withdrawals. The exchange said it found no evidence that a wallet private key leaked, which points toward stolen or forged authorizations rather than stolen keys. Co-CEO Richard Teng later said the attack was complex rather than a single action and that further points of breach had turned up. He added that the investigation had not assigned responsibility to any individual.

From one laptop to additional points of breach

BleepingComputer reported that Binance tied the roughly $6.3 billion theft to a compromised laptop used by a DevOps engineer, and that framing spread quickly. The Hackread account quotes Pieter Arntz of Malwarebytes cautioning that a compromised laptop may explain where an attack started but does not explain the full breach on its own.

The gaps are large. Binance has not described the additional breach points, how the engineer’s machine was compromised, or how access to internal systems turned into authorized withdrawals. It has promised a full post-mortem and technical report, which had not appeared as of October 30.

50 pre-signed authorizations and a sweeper contract

TRM Labs published the most detailed reconstruction in its analysis of the theft. On Ethereum, the attacker used an EIP-7702 delegation to turn a Binance hot wallet into a sweeper it controlled. It had prepared 50 pre-signed authorizations at consecutive transaction counts, one of which matched, and the wallet then sent out 167,464 ETH and 63 tokens, including 1.615 billion USDT. On the other nine chains, Binance wallets sent funds through ordinary signed transfers. A second wave around 23:05 UTC reached wallets on Avalanche and Polygon.

TRM assesses the most likely explanation as a compromise of Binance’s hot wallet signing infrastructure, and it labels that an assessment rather than a confirmed finding. Preparation began at least 36 hours before the theft. Hackread adds that the setup included funding through Tornado Cash and testing of the attack code.

Frozen stablecoins and what the attacker still holds

Stablecoin issuers did most of the clawing back. Tether chief executive Paolo Ardoino said Tether froze more than 1.567 billion USDT, and Circle chief executive Jeremy Allaire said Circle froze more than 800 million USDC while working with law enforcement, as Forbes reported. Binance co-CEO Yi He said Ripple helped stop about $200 million from moving, and TRM confirmed an onchain freeze of 40.5 million RLUSD. Arbitrum’s Security Council froze about $30.5 million. TRM puts total freezes near $2.7 billion, while Binance says nearly $3 billion. Former chief executive Changpeng Zhao cited lower figures for Tether and Circle, roughly $971 million and $823 million, and the Forbes piece does not reconcile them.

What remains with the attacker is harder to pin down. TRM estimates about $2.4 billion beyond issuers’ reach, including more than 420,000 ETH and 18,270 BTC, while Elliptic puts the attacker’s holdings near $3.33 billion across about 43 wallets. Julio Moreno of CryptoQuant tracked 18,270 BTC, about $1.42 billion, moving from a Binance cold wallet into 19 new addresses, 17 of them holding exactly 1,000 BTC. As of his post, none had reached an exchange, bridge or mixer.

Binance says it will cover all losses from its SAFU emergency fund and company money. SAFU holds 15,000 BTC after a $1 billion conversion in February, and it last paid out for a 7,000 BTC theft in May 2019. Deposits resumed, while withdrawals stayed paused during a security overhaul with a restart expected within 48 hours.

North Korea attribution and the Bybit comparison

TRM attributes the attack to TraderTraitor, North Korea’s hacking unit, with high confidence, citing on-chain and off-chain intelligence, and notes that the FBI named the same group for the February 2025 Bybit theft of about $1.5 billion. The Hacker News summary of the incident reports that Chainalysis also links the funds to North Korea with high confidence, pointing to commingling with proceeds of September’s Bitget exploit. Chainalysis chief executive Jonathan Levin separately assessed the North Korean link as likely, according to Hackread.

Elliptic is more cautious. Its chief scientist Tom Robinson sees similar tradecraft but notes differences in laundering speed and method and the lack of a confirmed root cause. Binance’s own statements name no attacker. The Bybit comparison also guards against a mix-up: that earlier $1.5 billion loss belonged to a different exchange and was traced to a developer’s infected laptop at a wallet software provider, not to Binance.

The open question is the one Binance itself has promised to answer. Until its post-mortem explains how the engineer’s laptop was compromised and what the additional breach points were, the laptop marks where the trail starts rather than where it ends.

This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.

Tech news in one quick read: Subscribe to TLDR →

We may earn a commission if you sign up.