Binance: $6.3 billion impacted, and it probably started with a laptop
Binance reports an incident affecting about $6.3B in assets, with nearly $3B frozen. Binance says it likely began with a DevOps engineer's laptop. What we know, what's still open, and what you should do.
Translated from the German original with an AI language model, approved by me. Read the original
Binance, the world's largest crypto exchange, has reported a "security incident". The company says assets worth about $6.3 billion were impacted. According to Binance, nearly $3 billion of that has been frozen on-chain so far, meaning it's locked directly on the blockchain and the attacker can no longer move it (The Hacker News).
Quite a bit has come out since my first post. Here's where things stand now, including what's still open.
What happened
On October 29, reports surfaced of very large outflows from Binance hot wallets. A hot wallet stays online all the time so the exchange can process withdrawals quickly. The funds went to a freshly created Ethereum address. At first, Binance would only say it was aware of "reports of a potential security issue" (BleepingComputer). Later, it gave $6.3 billion as its estimate of the total impact.
On the cause, Binance has said only that its initial investigation suggests the incident "may involve a compromised DevOps engineer's laptop." From that laptop, the attacker reportedly got into a service container and submitted unauthorized withdrawals. Binance says it has found no evidence that wallet private keys leaked (The Register). It has since admitted that the investigation "uncovered additional points of breach" beyond the laptop. There's no full root-cause analysis yet.
Blockchain analytics firm TRM Labs has laid out how it thinks the attack worked. Preparation started at least 36 hours earlier, with test runs a few hours before the attack. Then a single transaction emptied the hot wallet in about three and a half minutes. Elliptic thinks the attacker got Binance's own systems to sign the transactions instead of stealing keys (The Hacker News). That fits with the claim that no keys leaked, and it doesn't make things any better.
The numbers and what they mean
- Impacted: about $6.3B according to Binance. Chainalysis puts the value at the time of theft at roughly $5.9B. Elliptic says $6.43B.
- Frozen: Tether has frozen more than 1.567B USDT and Circle about 800M USDC. Elliptic puts all freezes combined at $2.84B.
- Still with the attacker: about $3.33B across roughly 43 wallets according to Elliptic, including ETH and BTC.
A note on framing, which also corrects my own post. I wrote that "impacted" is not "stolen". On whether funds actually left, that's settled. The analytics firms clearly call this a theft. It would be the largest crypto theft on record, well ahead of Bybit's $1.5 billion in February 2025. What's still open is the final loss once frozen and possibly recovered amounts are subtracted.
Stablecoins are tokens pegged to a currency like the US dollar. Tether and Circle could freeze funds this quickly because they control these tokens centrally. This time, that helped.
Who's behind it?
TRM Labs attributes the attack with high confidence to TraderTraitor, a North Korean group that has gone after crypto companies for years. Chainalysis also points to North Korea, in part because the funds were mixed with proceeds from the Bitget exploit. Elliptic urges caution until there's a root cause. Binance itself hasn't blamed anyone yet (The Hacker News).
Who's affected
First of all, every Binance customer, because deposits and withdrawals are suspended. Binance expects to restart withdrawals within 48 hours, once it has reworked the withdrawal service. It has pledged to cover losses from its SAFU fund and its own money. SAFU is an emergency fund Binance set up for exactly this kind of event. For now, that's a promise, and we'll see how it plays out.
What you should do now
If you use Binance:
- Once things are running again, check your balances and transaction history. If anything looks wrong, contact support, and only through the app or the official website.
- Turn on 2FA (two-factor authentication, a second code on top of your password) and the anti-phishing code. With that code set, genuine Binance emails include a phrase only you know.
- Expect phishing. After incidents like this, emails and messages show up about "compensation", "account verification" or "recovery services". Binance itself warns against unofficial links. No legitimate party will ask for your password or seed phrase.
- As a general rule, crypto you're not actively trading shouldn't sit on an exchange.
If you run a company: If a single developer laptop can open the way to billions, you have an architecture problem, not just an endpoint problem. TraderTraitor is known for fake job offers, coding tests and tampered software. Treat the devices of DevOps staff with production access like crown jewels. And no single system path should be able to sign large withdrawals without independent approval.
I'll update this once Binance publishes a root-cause analysis.