Binance disclosed on October 30 that a security incident affected about $6.3 billion in assets. Chainalysis estimates the theft at about $5.912 billion at the time it happened and calls it nearly four times the size of the next-largest crypto heist, the roughly $1.5 billion Bybit theft in February 2025. Elliptic puts the total at $6.43 billion. The Hacker News reported the details.
Binance says its initial investigation points to a compromised DevOps engineer's laptop. From there, the attacker reached a service container and submitted unauthorized withdrawal transactions. Binance says it has no evidence of a wallet private key leak. It has since said it found additional points of breach beyond the laptop. Co-CEO Richard Teng said the attacker did not simply use one engineer's permissions, and that the attack was not a single action. Binance has not published a root cause.
TRM Labs describes preparation that began at least 36 hours before the theft. At 20:20 UTC the operator submitted one transaction carrying 50 authorizations. Each was signed by the Binance hot wallet and pointed to a sweeper contract that accepts instructions only from the operator. Each authorization is valid only at one wallet nonce, so the attacker pre-signed 50 consecutive nonce values to make sure one would still be valid at execution. About three minutes and 24 seconds later, the operator told the hot wallet to send its entire balance to an attacker-controlled address. That moved 167,464 ETH and 63 tokens, including 1.615 billion USDT. TRM Labs says the most likely explanation is that the attacker could make Binance's hot wallet signing system sign transactions of its choosing.
Attribution points to North Korea. TRM Labs links the attack to TraderTraitor, the group behind the 2025 Bybit heist, with high confidence. Chainalysis also assesses DPRK involvement with a high degree of confidence. It saw funds stolen in the Bitget exploit commingle with Binance-stolen funds, and both incidents sent funds to the same Ethereum address. The attacker funded its wallet through three small Tornado Cash withdrawals and tested code on three wallets a few hours before the theft. Elliptic urges caution, citing differences in laundering speed and method, and the lack of a root cause. Social engineering is suspected, a tactic seen in earlier DPRK-linked heists.
Freezes recovered part of the loss. Elliptic reports $2.84 billion frozen. Tether, Circle, Ripple and World Liberty Financial froze about $2.67 billion in stablecoins, and Arbitrum froze about $30 million in ETH and ARB. Elliptic also says the attacker controls about $3.33 billion that issuers cannot freeze, spread across about 43 wallets. That includes 511,861 ETH, 18,270 BTC, 233 million XRP and 670 million TRX. Laundering is fast and automated. Elliptic saw the attacker hold stolen USDT for only 37 minutes on Ethereum and 46 minutes on Tron. Chainalysis reports thousands of transactions in a short period, with large swaps through market makers and lending protocols rather than the bridge-heavy pattern seen after Bybit.
Binance suspended deposits and withdrawals, revoked the affected address authorization, and engaged law enforcement and blockchain intelligence partners. It says it will cover all losses from its SAFU fund and its own funds, and expects withdrawals to resume in 48 hours after a security revamp of the withdrawal service.
Why it matters. This is a workstation-to-signing-infrastructure compromise, not a smart contract bug. One developer endpoint appears to have been a path to production signing. The defensive lessons are familiar: isolate signing services from engineer endpoints, require out-of-band verification and policy limits on hot wallet withdrawals, alert on pre-signed or batched authorizations and unusual sweeper contracts, and treat DevOps laptops as privileged assets with hardware-bound credentials. Teams should also harden against targeted social engineering of engineers, which remains the leading suspected entry point for DPRK crews.
