Binance links $6.3B theft to a compromised DevOps engineer laptop

Binance says the theft of about $6.3 billion from its hot wallets on October 29 appears to have started with a compromised laptop belonging to one of its DevOps engineers. According to the exchange's initial findings, the attacker used that laptop to reach a service container and submitted withdrawal transactions that Binance's own systems then processed. On October 31 the FBI attributed the attack to North Korea.

Few small businesses run a crypto exchange, but most have a few laptops that can push code, change DNS, or log into a hosting control panel. The same kind of access is what failed here.

Timeline of the October 29 withdrawals

Blockchain analytics firm TRM Labs counted roughly $6.36 billion leaving Binance wallets across ten blockchains, most of it within about 20 minutes starting at 20:05 UTC. TRM says preparation began at least 36 hours earlier, with operator wallets funded through Tornado Cash. Binance's own estimate is about $6.3 billion and the FBI statement uses $6 billion. Either way it is the largest crypto theft on record, roughly four times the $1.5 billion taken from Bybit in February 2025.

Binance suspended deposits and withdrawals, revoked permissions tied to the affected address, and said it will cover all customer losses from its SAFU reserve and company funds. Deposits are running again. Co-founder Yi He said withdrawals were expected to resume by Sunday, November 1.

Binance's account of the entry point

Binance's initial investigation names the engineer's laptop as the starting point, with access then extended to a container that could submit withdrawals. The company says it has found no evidence that wallet private keys were stolen. It later reported "additional points of breach" without saying where, and has promised a technical post-mortem. It has not said how the laptop was compromised, which credentials on it were used, or why a container with authority to move funds was reachable from an engineer's machine.

The FBI, working with the Secret Service and IRS Criminal Investigation, tied the theft to TraderTraitor, the North Korean group it also blamed for Bybit, and published 628 wallet addresses for exchanges and DeFi services to block. TRM Labs and Chainalysis made the same attribution with high confidence. Stablecoin issuers and partners have frozen about $3 billion, which stops those funds from moving but does not return them.

Bybit began the same way. That theft was traced to a compromised developer machine at wallet provider Safe{Wallet}, which the attackers used to reach Safe's AWS environment and alter JavaScript that Bybit's signers loaded.

Credentials stored on a typical website admin's laptop

A laptop used to manage a small-business website usually holds most of the following:

• SSH private keys in ~/.ssh, often without a passphrase, with matching authorized_keys entries on every server.
• Cloud CLI credentials in ~/.aws/credentials or the equivalent, frequently long-lived access keys with an administrator policy.
• .env files in cloned repositories, with database passwords, payment gateway keys, and SMTP credentials.
• Browser session cookies for the registrar, DNS provider, hosting control panel, and wp-admin. A stolen session cookie bypasses both the password and the MFA prompt.
• Git credentials that can push to a branch that deploys automatically.

Malware running as the logged-in user can copy all of it without any privilege escalation.

Hardening SSH, cloud keys, and deploy paths

Move SSH keys onto hardware. OpenSSH 8.2 and later support FIDO2 security keys, which need a physical touch for each use and cannot be copied off the token:

ssh-keygen -t ed25519-sk -O resident -O verify-required -C "admin-laptop-2026"

Malware can still use an open session while the key is plugged in, but it cannot take the key and use it later from another machine.

Limit where each key works. A from= option in authorized_keys restricts a key to known source addresses such as a VPN or bastion host:

from="203.0.113.10",no-agent-forwarding,no-port-forwarding sk-ssh-ed25519@openssh.com AAAA... admin-laptop-2026

Replace static cloud access keys with SSO sessions (aws sso login on AWS) that expire after hours. Run aws iam generate-credential-report, then aws iam get-credential-report, to find old or unused access keys and delete them.

Keep production secrets off laptops. Developers can work from a staging .env with test keys. Run deployments from CI with their own scoped credentials and require review on the production branch, so a laptop can propose a change but cannot ship it alone.

Use a separate browser profile with no extensions for registrar, DNS, and hosting panel logins. Extensions with broad permissions can read cookies for every site the profile visits.

Second approvals and alerts for high-impact changes

Binance's withdrawals went through because the system accepted requests from a component that was allowed to send them. For a business website, the comparable actions are nameserver and MX changes, payment gateway settings, new administrator accounts, and bulk exports of customer data. Each should require more than one stolen credential, or at least alert someone:

• Enable registrar lock, and where the registrar offers it, require a second approver for transfers and nameserver changes.
• Send alerts for new WordPress administrators and new SSH keys to a mailbox the admin laptop is not signed into.
• Set limits and alerts on refunds, payouts, and data exports in the store or CRM.
• Log control panel and cloud console logins with source IP addresses, and review new addresses every week.