Binance Puts Its Hack at $6.3 Billion and Blames an Engineer's Laptop; Analysts Point to North Korea

Binance now puts the theft from its hot wallets at "around $6.3B" and says the way in was "a compromised DevOps engineer's laptop, which allowed an attacker to gain access to a service container". Blockchain analysis firms TRM Labs and Chainalysis both attribute the attack to TraderTraitor, a North Korean hacking unit. TRM calls it the largest hack in history. Binance itself hasn't named a culprit.

The exchange says about $3 billion has been frozen on-chain, up from the $2.54 billion it reported early on 30 October (the first report on the drain).

How it happened

Binance's update of 30 October says it found "no evidence of any wallet private key leak". Later that day chief executive Richard Teng told CoinDesk that investigators had found "additional points of breach" and hadn't yet worked out the full sequence. CoinDesk reports the attackers abused Ethereum's EIP-7702 account-delegation feature to take control of a hot wallet without going through Binance's normal approvals.

TRM's reading is broader. It says the attacker got valid signatures across several chains within about half an hour, which "points to a compromise of Binance's hot wallet signing infrastructure", and that most of the money left in about 20 minutes starting at 20:05 UTC on 29 October.

The case for North Korea

TRM makes the call "with high confidence", citing small Tornado Cash withdrawals that funded an operator wallet and staging that began well before the theft. Chainalysis reaches the same name because Binance funds were mixed with proceeds of last month's Bitget exploit, which had already been attributed to North Korea. Elliptic is more cautious: it calls North Korea-linked actors "likely" and notes the attacker has been slow to convert the coins, unlike past North Korean thefts.

No government has named the attacker. Elliptic points out that the FBI named Bybit's attacker within five days; there's no such statement on Binance yet. Binance says it is "working closely with our law enforcement partners to confirm the identity of these criminals".

The numbers

The three firms land within $70 million of each other: TRM puts the haul at about $6.36 billion, Chainalysis at approximately $6.4 billion and Elliptic at $6.43 billion. The biggest freezes came from the stablecoin issuers, about 1.77 billion USDT at Tether and about 825 million USDC at Circle. The attacker still holds more than 420,000 ETH and 18,270 BTC, about $2.4 billion beyond any issuer's reach, and TRM expects it to move next through cross-chain bridges and over-the-counter brokers.

For Binance customers

Withdrawals are still suspended while security checks are completed, and Binance says it will cover all losses from the SAFU fund and the company's funds.

Teng told CoinDesk he hopes to resume withdrawals by Sunday, 1 November, and that a full proof-of-reserves report follows on Monday. CoinDesk also found that the drained wallets had been listed among the assets backing customer balances in Binance's reserve data.