Binance: $6.36 Billion Stolen in Record Crypto Heist via Compromised DevOps Laptop
A compromised DevOps engineer's laptop let attackers drain roughly $6.36 billion from Binance wallets across ten blockchains on October 29, 2026: the largest crypto theft on record, which the FBI attributes to North Korea's TraderTraitor (Lazarus Group). About $2.7 billion has been frozen and Binance says it is covering all losses from its SAFU and company funds.
An attacker moved approximately USD 6.36 billion out of Binance wallets on ten blockchains on October 29, 2026, in the largest cryptocurrency theft on record, a breach the exchange traces to a compromised DevOps engineer's laptop and the FBI attributes to North Korean hackers. Most of the funds were moved in about 20 minutes starting at 20:05 UTC, according to blockchain analysis firm TRM Labs, as reported by BleepingComputer. On November 1, 2026, the FBI published a security alert attributing the theft of "more than $6 billion USD in virtual assets" to North Korea, BleepingComputer reports.
What was the specific vulnerability?
The entry point was a compromised laptop belonging to a Binance DevOps engineer, which gave the attacker access to a service container and the ability to submit unauthorized withdrawal transactions. According to BleepingComputer, Binance said it has not found evidence of a leaked wallet private key, meaning the theft did not involve the direct compromise of cryptographic key material. Binance Co-CEO Richard Teng said in a statement: "To be clear: the attacker did not simply use one engineer's permissions, and this was not a single 'one-click' action. It involved a more complex attack process. Our investigation has not attributed responsibility to any individual." The company also said it "uncovered additional points of breach" but was "still gathering the facts, and will share more directly as we have them." Blockchain analysis firms traced the operation to TraderTraitor, also tracked as Lazarus Group, Jade Sleet, and APT38, a cluster whose prior crypto attacks include the $1.5 billion Bybit hack of February 2025, the $387.5 million Bitget theft of September 2026, the $280 million Drift hack of April 2026, and the $308 million DMM Bitcoin theft of May 2024, often executed through employee device compromise and fake-recruiter social engineering known as "Operation DreamJob."
How was the incident detected?
The theft was detected on October 29, 2026, the same day the funds moved, and Binance confirmed the breach publicly that day. In a statement shared with BleepingComputer on October 30, the exchange linked the incident to the compromised DevOps laptop. TRM Labs attributed the attack to TraderTraitor on or around October 30, and Chainalysis confirmed the attribution "with a high degree of confidence." The formal government attribution followed on November 1, 2026, when the FBI published a security alert tying the theft to North Korea and listing 628 cryptocurrency addresses tied to the laundering: 608 on Ethereum, 19 on Bitcoin, and 1 on Solana, according to BleepingComputer's report on the FBI alert.
What is the current impact?
Approximately $2.7 billion of the stolen funds has been frozen, about $2.4 billion remains attacker-controlled, and Binance says it has covered roughly 95 percent of the losses from its own funds. Stablecoin issuers Tether, Circle, Ripple, and World Liberty Financial froze about USD 2.67 billion, and Arbitrum's Security Council froze 8,426 ETH and 74.6 million ARB, per BleepingComputer. The funds still beyond any issuer's reach amount to more than 420,000 ETH and 18,270 BTC. The FBI expects the stolen assets to be laundered through DeFi platforms and instant swap services, and together with the U.S. Secret Service and IRS Criminal Investigation is asking exchanges and virtual asset service providers to block transactions linked to the listed addresses. Binance suspended deposits and withdrawals after the incident and revoked authorizations for the affected address. In a statement to BleepingComputer, the company said: "Our commitment remains unchanged: Binance will bear the financial impact of the stolen funds. These losses will not be passed on to users." As of November 1, Binance said it had covered approximately 95 percent of the impacted amount, up from 90 percent, with the remaining 5 percent in less-liquid tokens being purchased through market and OTC channels.
What are the next steps?
Binance plans to resume the first phase of withdrawals on November 1, 2026, between 06:00 and 09:00 UTC, while its investigation into the additional points of breach continues. The company said it is working with blockchain intelligence partners and law enforcement, and that "Binance will cover all losses from the SAFU fund and the company's funds. User funds are safe." On the government side, the FBI, U.S. Secret Service, and IRS Criminal Investigation are coordinating with exchanges and virtual asset service providers to freeze and block transactions tied to the 628 listed laundering addresses. Binance has not attributed responsibility to any individual employee, and Teng said the investigation into the full attack chain is ongoing.
By the numbers
Source snapshot
