Cryptocurrency exchange Binance has said its preliminary investigation into the theft of about $6.3 billion in digital assets points to a compromised laptop belonging to one of its DevOps engineers, as United States authorities linked the attack to a North Korean state-backed hacking group.
Binance said the compromised device enabled the attackers to gain access to a service container and submit unauthorised withdrawal transactions, although the company stressed that the incident was more complex than the compromise of a single employee’s account.
The attack, which occurred on October 29, involved the movement of billions of dollars in cryptocurrency across several blockchain networks within a short period, making it the largest recorded crypto theft.
According to Binance, its initial investigation found no evidence that the private keys controlling its cryptocurrency wallets were leaked.
“Binance’s initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions,” the exchange said.
It added that it had discovered other points of compromise as investigations continued.
Binance Co-Chief Executive Officer Richard Teng cautioned against interpreting the incident as the work of one employee or the result of a single mistake.
“To be clear: the attacker did not simply use one engineer’s permissions, and this was not a single ‘one-click’ action. It involved a more complex attack process,” Teng said.
Binance estimated the impact of the breach at about $6.3 billion and said it had worked with blockchain companies and other industry partners to freeze billions of dollars in affected assets.
The exchange also pledged that customers would not bear the losses, saying the stolen assets would be covered through its Secure Asset Fund for Users and company resources. Reuters reported that Binance set aside more than $6.34 billion to cover the fallout from the attack.
The Federal Bureau of Investigation subsequently attributed the theft to TraderTraitor, a North Korean state-sponsored hacking operation associated with attacks on cryptocurrency companies.
The FBI said it had observed the attackers converting stolen assets into Ethereum and warned cryptocurrency exchanges and other virtual-asset service providers to block transactions linked to hundreds of addresses associated with the stolen funds.
The development came just two days after Binance said its security team had detected and blocked multiple North Korea-linked cyberattack attempts associated with a social-engineering campaign known as “Contagious Interview.”
Under the campaign, attackers pose as recruiters or employers and lure developers and technology workers with fake job interviews, coding exercises or requests to install software. Victims may then be persuaded to execute malicious programs capable of stealing credentials or giving attackers access to their computers.
Binance said on October 27 that the attempts it detected had caused no system damage or asset losses and warned users and employees against running code from unknown sources or installing unauthorised software.
However, Binance has not publicly said that the DevOps engineer whose laptop was compromised in the October 29 breach was targeted through the “Contagious Interview” campaign.
Cybersecurity researchers have therefore cautioned against assuming that the two incidents were directly connected until Binance completes and publishes its promised technical investigation.
The technique of using fake recruitment opportunities to compromise technology workers is not new.
In 2024, cybersecurity researchers warned that North Korean operatives were obtaining remote technology jobs at Western companies using fabricated identities and employment histories. In some cases, workers gained legitimate access to corporate systems before attempting to steal data or install malicious software.
Cybersecurity company KnowBe4 also disclosed in 2024 that it had unknowingly hired a North Korean-linked IT worker who used a stolen identity and an AI-altered photograph during the recruitment process. Suspicious activity began shortly after the worker received a company-issued computer.
Binance’s latest breach has renewed concerns over such social-engineering attacks and the security risks created when hackers compromise employees who have access to sensitive corporate infrastructure.
Teng said Binance would publish a detailed technical post-mortem after its investigation is completed and the facts surrounding the breach have been fully verified.
Binance has maintained that customer funds remain protected and said it would absorb the financial impact of the theft rather than pass the losses on to users.
Post Title: “Compromised DevOps Laptop Opened Door To $6.3bn Hack” — Binance Says, FBI Links Attack To North Korea By Naijaonpoint.