A compromised DevOps laptop caused the $6.3B Binance breach

Cryptocurrency Exchange Binance blamed a compromised DevOps laptop for the loss of $6.3 billion in cryptocurrency last week, adding that it will now cover any losses faced by its customers. “Binance will cover all losses from the Secure Assets Fund for Users (SAFU) and the company’s funds,” the world’s largest cryptocurrency exchange said in an update on Friday, adding that user funds are safe and that it had found no evidence of wallet private-key leakage during its investigation of the incident. It had frozen approximately $3 billion in assets on-chain, temporarily suspending withdrawals while security checks were completed, and revoking the affected address authorization. Withdrawals are now being restored in phases, initially reopening services across 15 networks, including Bitcoin, Ethereum, Solana, and XRP. Binance says it has replenished approximately 95% of the affected assets using company funds, while the remaining 5%, comprising less-liquid tokens, could take longer to source. The exchange said its preliminary investigation pointed to a compromised employee device that enabled access to a service container involved in withdrawals. “This attack, reportedly on a development engineer, highlights that security is a critical element of every operational stage and personnel level,” said Tim Rawlins, senior advisor and director of security at NCC Group. “When security failures in trusted identities and administrative access can be targeted, attackers can exploit more than just the underlying technical vulnerabilities.” The FBI has since attributed the attack to North Korean threat actors, identifying the TraderTraitor hacking group as responsible for the theft. “Given what we know about the activities of countries like North Korea in targeting cryptocurrency, it’s unsurprising that attackers are prepared to invest considerable efforts in targeting individuals who have access to the building blocks of the exchanges,” Rawlins said. A compromised laptop reaches the withdrawal pipeline Binance’s preliminary findings suggest that attackers compromised a DevOps engineer’s laptop before gaining access to a service container and submitting unauthorized withdrawals. The exchange has yet to publish technical details of the attack, leaving important questions about the precise intrusion path and how the attackers navigated its internal systems. “A platform holding digital assets should have multiple layers of security to prevent a single compromise, such as an employee’s laptop being hacked, from being sufficient to authorize a transfer,” said Mario Rivas, blockchain and digital assets security lead at NCC Group. The reported attack is similar to the February 2025 Bybit breach, in which attackers compromised a developer’s machine at Safe{Wallet} and manipulated the interface presented to transaction signers. However, the Binance incident involved a different mechanism. F6’s Threat Intelligence Department (TID) said the Binance attack reportedly targeted an automated withdrawal process rather than directly deceiving authorized signers. Evgeniy Yanov, Head of Audit and Consulting Department at F6, cited Crypto security platform Blockaid, highlighting a batch of 50 EIP-7702 authorizations within a single transaction, alongside delegation to a malicious “sweeper” contract, as an unusual feature of the reported attack. “This specific mechanism has not been seen before in large-scale breaches of this size,” Yanov said. FBI points to North Korea’s TraderTraitor operation The FBI has attributed the attack to TraderTraitor, an elite North Korean hacking unit considered part of the broader Lazarus infrastructure. The agency, working with the US Secret Service and IRS Criminal Investigation, said it had observed the attackers converting stolen assets privately into Ethereum. It warned that the funds could subsequently be laundered through decentralized finance platforms and instant-swap services. F6’s TID said the attribution was based on a combination of on-chain and off-chain intelligence. “The group’s signature matches previous thefts: small Tornado Cash withdrawals used to fund the operator’s wallet, extensive preparation well before the actual heist, and pre-signed transactions executed in a single burst,” it added. TID researchers noted similarities with previous North Korean-linked cryptocurrency thefts, including the Bybit and KelpDAO incidents. However, they cautioned that Binance has not independently named the perpetrators and that the full attribution evidence has not been published. Binance did not immediately respond to a request for comment. NCC Group’s Rawlins noted that the growing use of AI could help attackers chain vulnerabilities and operational weaknesses together, while organizations increasingly face adversaries willing to invest considerable effort when the potential financial return is substantial. “Good cyber hygiene and effective security fundamentals are key to defending against attacks that many organizations are still missing,” he said.