Binance Says Compromised Engineer Laptop Led to Roughly $6.3 Billion Crypto Theft; Analysts Blame North Korea

Binance said on October 30 that a security incident involving about $6.3 billion in cryptocurrency began with a compromised laptop belonging to an engineer, and blockchain analytics firms are attributing the theft to North Korean hackers, according to TechCrunch. If the figures hold, it would be the largest known crypto theft in history.

What Binance says happened

In a post on X, Binance said an engineer's laptop was compromised, letting an attacker reach a service container and submit unauthorized withdrawal transactions. The exchange said it has seen no evidence of a private key leak. It suspended deposits and withdrawals and said user funds are safe, although it did not immediately provide proof.

• A spokesperson said about $3 billion has been frozen with industry partners and that recovery of affected assets has begun.
• Binance said it will publish an updated proof of reserves once remediation is complete.
• How the laptop was first compromised remains unclear, and Binance did not respond to TechCrunch's question on whether a third party had audited its security before the incident.

Attribution

TRM Labs and Elliptic attribute the theft to North Korean hackers, a cluster the industry tracks as TraderTraitor. TRM estimates that roughly $6.36 billion left Binance wallets across ten blockchains, most of it in about 20 minutes. Elliptic said some of the stolen funds reached a wallet previously used in a $351 million attack on Bitget earlier this year. The attribution rests on private-sector analysis; no public indictment tied to this incident has been reported.

Context

The 2025 Bybit theft of about $1.4 billion, also attributed to the same group, is now the second-largest on record, TechCrunch noted. Totals differ by firm because each counts assets and chains differently, and Binance's figures may change as its investigation continues.

Users are advised to rely on Binance's official channels and to be wary of unsolicited messages offering fund recovery or compensation.