Binance Links $6.3 Billion Crypto Theft to Compromised DevOps Laptop
Summary
Binance links about $6.36 billion in unauthorized withdrawals to a compromised DevOps laptop and service-container access. The exchange halted deposits and withdrawals; TRM and Chainalysis attribute the theft to TraderTraitor.
Key points
- Binance says attackers accessed a service container and submitted unauthorized withdrawal transactions; it has not found evidence that a wallet private key was leaked.
- Binance said the attack involved more than one engineer’s permissions and that its investigation has not attributed responsibility to an individual.
- TRM says approximately $6.36 billion was moved from Binance wallets across ten blockchains on October 29, 2026, with most moved in about 20 minutes.
- TRM attributed the attack to TraderTraitor, and Chainalysis said with high confidence that the group was responsible. Binance itself did not name a threat actor.
- TRM reported that issuers and Arbitrum froze roughly $2.7 billion in assets, while about $2.4 billion remained beyond issuers’ reach.
- Binance suspended deposits and withdrawals, revoked authorizations for the affected address, and said it would cover losses and publish an updated Proof of Reserves after remediation.
Article Details
- Victim Organization
- Binance
- Incident Type
- Compromise involving a DevOps engineer's laptop and access to a service container enabled attackers to submit unauthorized cryptocurrency withdrawals.
- Incident Date
- 2026-10-29
- Disclosure Date
- 2026-10-29
- Affected Data Size
- Approximately USD 6.36 billion in cryptocurrency was moved from Binance wallets, according to TRM; Binance described the theft as about USD 6.3 billion.
- Operational Impact
- Binance suspended deposits and withdrawals while conducting security checks, revoked authorizations for the affected address, and said it was working with blockchain intelligence partners and law enforcement to trace and recover funds. Binance said user funds were safe and it would cover losses.
- Ransom Or Extortion
- Unknown
- Claim Status
- confirmed
People
Threat Actors
APT38The article says TraderTraitor is also tracked as APT38. TRM attributed the Binance theft to TraderTraitor; Binance did not attribute the incident to a threat actor.Jade SleetTRM attributed the Binance theft to TraderTraitor. Chainalysis said with a high degree of confidence that TraderTraitor was responsible. Binance did not attribute the incident to a threat actor.Lazarus GroupThe article says TraderTraitor is also tracked as Lazarus Group. TRM attributed the Binance theft to TraderTraitor; Binance did not attribute the incident to a threat actor.