Binance Attributes $6.3B Crypto Theft to Compromised DevOps Laptop

Binance has identified a compromised DevOps engineer’s laptop as the entry point for a $6.3 billion cryptocurrency breach. The exchange confirmed it will cover all customer losses using its Secure Assets Fund for Users (SAFU) and company resources.

The FBI, in coordination with the US Secret Service and IRS Criminal Investigation, has attributed the theft to TraderTraitor, an elite North Korean hacking unit operating within the broader Lazarus infrastructure. Investigators observed the attackers converting stolen assets into Ethereum to facilitate laundering through decentralised finance (DeFi) platforms and instant-swap services.

Technical intrusion via service container

Preliminary findings indicate that attackers leveraged the compromised device to gain access to a service container responsible for processing withdrawals. This enabled the submission of unauthorised withdrawals without the need for wallet private-key leakage.

Evgeniy Yanov, Head of Audit and Consulting Department at F6, noted that the attack utilised an unusual mechanism involving a batch of 50 EIP-7702 authorisations within a single transaction, alongside delegation to a malicious “sweeper” contract. This method differs from the February 2025 Bybit breach, where attackers compromised a developer’s machine to manipulate the interface presented to transaction signers.

Mario Rivas, blockchain and digital assets security lead at NCC Group, remarked that a platform holding digital assets should implement multiple layers of security to prevent a single employee compromise from being sufficient to authorise a transfer.

Recovery and fund replenishment

Binance has frozen approximately $3 billion in assets on-chain and is currently restoring withdrawal services in phases. Initial service re-openings include 15 networks, such as Bitcoin, Ethereum, Solana, and XRP.

The exchange has already replenished roughly 95% of the affected assets. However, the remaining 5% consists of less-liquid tokens that the company noted could take longer to source.

Tim Rawlins, senior advisor and director of security at NCC Group, stated that the attack highlights how security failures in trusted identities and administrative access can be exploited even when underlying technical vulnerabilities are not the primary target.