Binance confirms record $6.3 billion hack after engineer laptop breach

Binance acknowledged a theft after an attacker gained entry through a compromised DevOps engineer’s laptop. The unauthorized access let the attacker manipulate a service container, draining funds before detection. The company emphasized that no private keys were exposed and has halted withdrawals across affected networks as a safety measure.

Cybersecurity researchers and industry observers point to North Korea’s TraderTraitor group as the likely perpetrator, though Binance has not officially confirmed the claim. The exchange’s Secure Asset Fund for Users (SAFU) and corporate reserves will compensate affected users, but analysts remain skeptical about whether existing funds can fully cover the losses. With $162.8 billion in managed assets and 335 million registered users worldwide, the impact extends far beyond the stolen sum.

Forensic analysis by blockchain security firm TRM Labs reveals the attack was meticulously planned over at least 36 hours. The hacker first tested withdrawals using Tornado Cash on October 28, 2026, before deploying malicious code just four hours after a final rehearsal. The actual theft unfolded in minutes, as the attacker bypassed Binance’s hot wallet signing system to generate valid transaction signatures across multiple blockchains.

Stablecoin providers and blockchain networks moved swiftly to contain the damage. Tether, Circle, Ripple, and World Liberty Financial froze $2.67 billion in stablecoins, while Arbitrum’s Security Council seized 8,426 ETH and 74.6 million ARB tokens. Binance confirmed $3 billion in frozen assets, but the attacker quickly converted 325 million USDT into 122,300 ETH at a steep discount. This left $2.4 billion in non-freezable assets, 420,000 ETH and 18,270 BTC, still circulating outside frozen accounts.

Experts warn that large-scale crypto thefts often rely on decentralized trading to evade recovery efforts. Bernardo Brites, CEO of Trace Finance, explained that stolen funds held in non-exchange wallets become increasingly difficult to reintroduce into traditional financial systems over time. The more ⁠time passes, the less likely they will be able to fold those funds into other exchanges or payment providers – they essentially get blacklisted.

Binance has not disclosed a full technical report on the breach, though an ongoing investigation is assessing whether further vulnerabilities exist. A detailed post-mortem will be published once findings are verified, though no specific timeline has been set for its release.