# North Korean hackers blamed for $6.3B Binance theft, largest crypto heist on record

> Original title: Techcrunch: North Korean hackers drained that $6.3B from Binance, the largest crypto theft recorded.

- Source: Rohan Paul
- Published: 2026-10-30T14:36:01.000Z
- Bad Influence: https://badinfluence.news/items/ilezwsh0zrkc9t8sriy6jnxrx
- Original: https://x.com/rohanpaul_ai/status/2116177308340097427

## Summary

Rohan Paul relays a TechCrunch report that North Korean hackers stole $6.3 billion from Binance, the largest crypto theft recorded. Binance says a compromised DevOps engineer's laptop gave an attacker access to a service container that submitted unauthorized withdrawals, and that it found no wallet private key leak. About $3 billion has been frozen on-chain, and Binance says it will cover all losses while deposits and withdrawals are suspended.

## Why it matters

The post explains how a compromised engineer laptop led to unauthorized withdrawals, which shows where exchange security can fail beyond wallet keys.

## Post

Techcrunch: North Korean hackers drained that $6.3B from Binance, the largest crypto theft recorded.

Binance traces the entry to a compromised DevOps engineer’s laptop, which reached a service container able to submit unauthorized withdrawals.

It found no sign that wallet private keys leaked, so the attacker apparently abused withdrawal software instead of seizing direct control of the crypto.

Partners have frozen about $3B as the funds crossed blockchains, and Binance has pledged to cover all user losses.

TRM Labs attributes the theft to TraderTraitor, the North Korean cell behind the previous record, the $1.5B Bybit heist in 2025.

Withdrawals stay suspended while Binance rebuilds its withdrawal service, and its claim that user funds are safe awaits an updated proof of reserves.

Investigators have also found additional breach points, so Binance must now explain how 1 engineer’s access reached systems that move billions.

![](https://badinfluence.news/api/img-proxy?u=https%3A%2F%2Fpbs.twimg.com%2Fmedia%2FHV4rhwpbsAApO9H.jpg&mode=thumb&exp=1793577600&sig=0015b4fbb7ef7c5d)

## Quoted post @binance

> Binance's initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions. We have found no evidence of any wallet private key leak. We will share a detailed technical post-mortem once the investigation is complete and the facts are fully verified.
> 
> The estimated total impact sits at around $6.3B. We have worked with blockchain partners to freeze affected assets, with ~$3 billion frozen on-chain so far.
> Binance will cover all losses from the SAFU fund and the company’s funds. User funds are safe. We will also publish an updated Proof of Reserves once the remediation is complete.
> 
> As an immediate precaution, Binance has:
> 
> - temporarily suspended deposits and withdrawals while security checks are completed;
> - revoked the affected address authorisation;
> - engaged law enforcement and blockchain intelligence partners to trace and recover funds.
> 
> Our teams are working around the clock to resolve this issue safely and thoroughly. We are working closely with our law enforcement partners to confirm the identity of these criminals and bring them to justice.
> 
> Please rely only on official Binance channels for updates. Please feel free to contact Binance Customer Support if you have any further questions.
> 
> https://www.binance.com/en/support/announcement/detail/c5a8729a97ac486d963784d96c5642d7

https://x.com/binance/status/2115993361517891592