"To be clear: the attacker did not simply use one engineer's permissions, and this was not a single 'one-click' action. It involved a more complex attack process. Our investigation has not attributed responsibility to any individual," Binance Co-CEO Richard Teng said.
Binance's account: a compromised DevOps laptop and service-container access
Binance has linked the theft of roughly USD 6.3 billion in cryptocurrency to a DevOps engineer's compromised laptop. According to the company, once attackers gained access they were able to submit unauthorized withdrawal transactions after they accessed a service container. Binance said it has not yet found evidence of a leaked wallet private key and that it "uncovered additional points of breach" while "still gathering the facts, and will share more directly as we have them."
Immediate remediation: suspensions, revocations, and financial backstops
In response to the incident the exchange suspended deposits and withdrawals while conducting security checks, revoked authorizations for the affected address, and said it is working with blockchain intelligence partners and law enforcement to trace and recover stolen funds. Binance told BleepingComputer that "Binance will cover all losses from the SAFU fund and the company's funds. User funds are safe. We will also publish an updated Proof of Reserves once the remediation is complete."
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildAttribution and timeline: TRM and Chainalysis reports
Blockchain analysis firm TRM attributed the attack to TraderTraitor, which it described as "a North Korean state-backed hacking unit also tracked as Lazarus Group and APT38." TRM reported: "On October 29, 2026, an attacker moved approximately USD 6.36 billion out of Binance wallets on ten blockchains, most of it in about 20 minutes starting at 20:05 UTC." Chainalysis independently confirmed TRM Labs' findings, stating with "a high degree of confidence" that TraderTraitor is responsible for the Binance USD 6.4 billion hack.
Frozen funds, raced freezes, and assets beyond issuer control
Stablecoin issuers and network authorities immediately moved to limit damage. TRM said that "Tether, Circle, Ripple and World Liberty Financial froze about USD 2.67 billion in stablecoins, and Arbitrum's Security Council froze 8,426 ETH and 74.6 million ARB on its network, for a total of roughly USD 2.7 billion." TRM added that the attacker "raced the freezes by selling USDT to market makers and borrowing ETH against USDT on Aave," and that the threat actor now holds more than 420,000 ETH and 18,270 BTC — "about USD 2.4 billion in assets beyond any issuer's reach."
What this means for technologists, stablecoin issuers, and Binance users
- Technologists and security teams: The company’s description that the incident involved a compromised DevOps laptop and subsequent service-container access underscores how initial access to credentials or workstations can enable transaction-level actions. As TRM observed, "Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply."
- Stablecoin issuers and network councils: Tether, Circle, Ripple, World Liberty Financial and Arbitrum's Security Council moved quickly to freeze tokens and network assets, collectively freezing about USD 2.7 billion in value — a concrete demonstration of what issuers and councils can do on short notice to limit on-chain movement.
- Binance users and customers: Binance has pledged to cover losses from the SAFU fund and company funds and to publish an updated Proof of Reserves after remediation. Meanwhile deposits and withdrawals remain suspended as the exchange conducts security checks and revokes affected authorizations.
This incident now stands as the largest recorded crypto heist: TRM called the USD 6.36 billion movement "the largest crypto theft on record," roughly four times larger than a USD 1.5 billion theft TRM previously linked to TraderTraitor in February 2025. Binance, blockchain intelligence firms, and law enforcement are pursuing tracing and recovery, while issuers and network councils continue to freeze and contain what they can. The public record from the involved parties leaves open the timeline for a full remediation report and the ultimate recovery of assets.
