Binance links $6.3 billion crypto theft to compromised DevOps laptop

What it is

On 29 October 2026, an attacker moved about USD 6.36 billion out of Binance wallets on ten blockchains, most of it in roughly 20 minutes from 20:05 UTC (TRM Labs). TRM calls it the largest crypto theft on record, about four times the USD 1.5 billion Bybit hack of February 2025. Binance traces the access to a DevOps engineer's compromised laptop.

How it works

Binance says the laptop gave attackers access to a service container, from which they submitted unauthorized withdrawal transactions. Co-CEO Richard Teng said the attacker did not simply use one engineer's permissions and that this was not a single "one-click" action, but "a more complex attack process." Binance says it has "uncovered additional points of breach" and has found no evidence of a leaked wallet private key. The page gives no further detail on the container, the credentials or the initial compromise.

The laundering followed a pattern TRM describes. The attacker raced the stablecoin freezes by selling USDT to market makers and borrowing ETH against USDT on Aave. It now holds more than 420,000 ETH and 18,270 BTC, about USD 2.4 billion that no issuer can freeze.

Response and recovery

• Tether, Circle, Ripple and World Liberty Financial froze about USD 2.67 billion in stablecoins.
• Arbitrum's Security Council froze 8,426 ETH and 74.6 million ARB. Total frozen is roughly USD 2.7 billion.
• Binance suspended deposits and withdrawals for security checks and revoked authorizations for the affected address.
• Binance is working with blockchain intelligence partners and law enforcement.
• Binance says it will cover all losses from the SAFU fund and company funds, and will publish an updated Proof of Reserves once remediation is complete.

Caveats

• Binance has not attributed the attack to any group or individual. TRM attributes it to TraderTraitor (also tracked as Lazarus Group and APT38), and Chainalysis confirms this "with a high degree of confidence."
• Chainalysis puts the figure at USD 6.4 billion, TRM at 6.36 billion, and the summary's 6.3 billion is Binance's own rounding.
• Binance says its investigation is ongoing and more findings will follow. The page offers no indicators of compromise, no technical detail on the laptop compromise and no defensive guidance.