Binance traces $6.3B hack to engineer’s hacked laptop

Binance said its preliminary investigation points to a compromised laptop belonging to a DevOps engineer. According to the exchange, the laptop gave attackers access to a service container, which they used to submit unauthorized withdrawals in what is likely the largest crypto theft on record. The exchange said it found no evidence that wallet private keys leaked. It pledged to cover all customer losses from its Secure Asset Fund for Users (SAFU) and company funds, CSO Online reported.csoonline.com

The account is still incomplete. Binance later said it had "uncovered additional points of breach" and called the incident a "complex attack." Co-CEO Richard Teng said the attacker used a "self-destruct mechanism" to hide their tracks, according to Business Insider. The company has promised a detailed technical postmortem once its investigation is complete.businessinsider.com

FBI names North Korea

In an alert dated Saturday, Oct. 31, the FBI said North Korea was responsible for stealing more than $6 billion from Binance on or about Oct. 29. The bureau named the state-backed group TraderTraitor and said the hackers were converting the stolen assets mainly into Ethereum ↘ 0.80%, Help Net Security reported. The alert lists 608 Ethereum addresses, 19 Bitcoin ↘ 0.96% addresses and one Solana ↘ 1.02% address. It asks crypto service providers to block transactions linked to them, according to SecurityWeek. TraderTraitor was also blamed for the $1.5 billion Bybit hack in 2025, the BBC noted. Researchers at F6 said this attack appeared to target an automated withdrawal process rather than trick the people who authorize transactions, CSO Online reported.securityweek.com+3

Withdrawals resume, outflows climb

Binance began restoring withdrawals in phases on Sunday, Nov. 1. It said it had replaced about 95% of the affected assets, and that the remaining 5% were less liquid tokens that will take longer to source, according to Seeking Alpha via TradingView. Roughly $3 billion has been frozen on-chain. In the first nine and a half hours after reopening, customers pulled a net $3.64 billion from the exchange, CNBC Comcast Corporation ↗ 0.49% reported. A spokesperson later put net outflows at $4.72 billion, or about 2.8% of the assets on the platform. Analysts said that was a fairly modest share, BNN Bloomberg reported. On Monday, Binance also restored fiat withdrawals in several currencies, including U.S. dollars, according to a Yahoo Finance report.tradingview.com+3

Viral spy claim debunked

A viral post on X claimed the hacked engineer had a romantic relationship with a North Korean spy and left a laptop unattended, and it credited the claim to blockchain investigator ZachXBT. A fact-check by The Crypto Times found nothing in ZachXBT's published work, Binance's disclosures or the FBI's alert to support the claim, and rated it false. Teng has said the investigation has not assigned blame to any individual. Binance told the outlet, "This claim is completely false. It should be removed and reported as false information."cryptotimes.io