Binance hack: how a compromised developer laptop can lead to a $6.3 billion breach

What it is

Aikido Security's post on the Binance incident, which Binance puts at about $6.3 billion. Binance says it may have started with a compromised DevOps engineer's laptop that gave access to a service container able to submit unauthorized withdrawals. About $3 billion has been frozen on-chain, and Binance says it will cover all losses. The post is a vendor explainer, and it says the public statements do not explain how the laptop was compromised. Everything about the attack path is Aikido's account of how such attacks typically unfold.

How it works

Aikido's plausible chain has four steps:

1. Malicious code on the laptop collects credentials and session tokens.
2. The attacker uses them to reach an internal system the engineer can access, such as a build server or cloud account.
3. The attacker moves to systems with broader reach, collecting more credentials at each step.
4. The attacker reaches a service trusted to submit withdrawals and sends transactions through it.

This would explain why no keys were stolen. Keys normally sit in a vault or hardware device, and an approval service asks the vault to use them without seeing them, so controlling the service is enough. Blockaid's CEO reached the same preliminary view: a compromise of signing infrastructure.

Session tokens can outlive a password reset and bypass MFA. Activity under them appears in logs as the engineer's own.

Aikido's Bybit comparison, citing Safe's preliminary findings via heise:

• 4 February 2025: a developer laptop was compromised.
• Following days: a stolen AWS session token was used inside the cloud.
• 17 February: malicious code was injected.
• 21 February: the theft took place.

Bybit's forensic update, via Cointelegraph, says signers were deceived into approving a malicious transaction.

Preconditions / Affected

Any organisation where developer machines hold long-lived cloud, SSH, git or Kubernetes credentials on disk, and where one service can approve high-value actions on its own.

Delivery routes the post names for North Korea-linked groups:

• A fake job interview with a take-home coding test.
• Package install scripts.
• Malicious editor extensions. Aikido says one in VS Code, in May, let an attacker breach GitHub's internal repositories.
• PolinRider, which hides scrambled code in project config files. It can run when a project is opened in VS Code, then uses the developer's access to rewrite commit history and overwrite the shared copy of every repository they can push to.

Aikido also describes the npm package react-html2pdf.js (March 2025), which posed as a popular library. It used no install script and fetched its payload from a remote server at run time. The payload targeted crypto wallets and browser data. Aikido attributes it to Lazarus Group.

What to do

• Keep long-lived credentials off developer disks and issue short-lived ones that expire in hours.
• Require approval outside the service for withdrawals and similar actions, so a compromised service cannot approve its own transactions.
• Alert on credentials and sessions used from places or at times the engineer never works from.
• Put contractor and personal machines that reach production under company management.
• Block malicious packages, extensions and AI tools at install time. Aikido's own Device Protection agent does this and holds back anything published in the last 48 hours by default.

Caveats

• Binance says later work found additional breach points beyond the laptop, and gave no details. A technical post-mortem is promised.
• Co-CEO Richard Teng wrote on X that the attacker did not simply use one engineer's permissions and that the attack involved more than a single click.
• TRM Labs and Chainalysis attribute the incident to TraderTraitor, a North Korean unit. Binance has not confirmed this.
• Binance reports no evidence of a wallet private key leak so far.
• Aikido says it blocked nearly 500 malware attacks on developer devices in the week before writing, which is its own telemetry.