Binance, the world's largest cryptocurrency exchange, confirmed that on October 29 assets were drained from it in an incident it estimates at about $6.3 billion. It is the largest crypto theft on record, and what should worry anyone who manages infrastructure most isn't the amount: according to the company itself, it may all have started with a compromised DevOps engineer's laptop, and not with a stolen private key.
What Binance confirmed
In its official announcement, Binance says its initial investigation points to a compromised laptop belonging to a DevOps engineer that gave the attacker access to a service container, from which unauthorized withdrawal transactions were sent. The company says it found no evidence that private keys to its wallets were leaked and promises a technical post-mortem once the investigation wraps up.
The official numbers:
- Estimated impact: around $6.3 billion.
- Frozen on-chain: about $3 billion, with help from issuers and partners.
- Who pays: Binance says it will cover all losses with its SAFU emergency fund and company money, and that it will publish an updated proof of reserves when it's done.
- Measures: it suspended withdrawals while it carries out security reviews, revoked the authorization of the affected address, and called in authorities and blockchain analytics firms. Deposits are still working.
Its co-CEO, Richard Teng, clarified on X that the attacker "did not simply use an engineer's permissions" and that it was not a "one-click" action but "a more complex attack process." Binance later said it had found "additional points of intrusion," without giving details. Binance.US said it is not affected.
How the wallet was drained
The on-chain data tells part of the story that Binance still hasn't explained. According to TRM Labs, most of the funds left in about 20 minutes starting at 20:05 UTC (2:05 p.m. in Mexico City), from Binance wallets on ten blockchains. The preparation began at least 36 hours earlier, with small withdrawals from Tornado Cash to fund the operator's wallet.
On Ethereum, the attacker used EIP-7702, the feature that arrived in May 2025 with the Pectra upgrade and lets a regular wallet run the code of a smart contract. CoinDesk reconstructed the operation like this: a single transaction carried 50 authorizations signed by the wallet that Etherscan labels "Binance 14," each for a consecutive nonce, because the wallet was processing so many withdrawals that its counter kept changing. The network accepted the one that matched. Four minutes later, a "sweeper" contract pulled out about 167,464 ETH and about $1.6 billion in USDT in a single transaction.
The malicious delegation stayed active for almost four hours, so the attacker also swept up customer deposits that kept arriving at that wallet. On the other blockchains there was no EIP-7702: the funds left through normal signed transfers. For TRM, that points to a compromise of the signing infrastructure of Binance's hot wallets.
Who's behind it
TRM Labs and Chainalysis attribute the attack, with "high confidence," to TraderTraitor, the North Korean hacking unit the FBI named for the $1.5 billion Bybit theft in February 2025. Binance did not confirm that attribution and only said it is working with authorities to identify those responsible.
Tether and Circle froze more than $2.4 billion in stablecoins. TRM estimates the attacker still holds about $2.4 billion in ETH and BTC that no issuer can freeze.
What this means
My take: this theft didn't break the cryptography, it broke the operations. If the post-mortem confirms what Binance and TRM say, the attacker didn't need the keys, only to reach the system and the people who have permission to use them. Check Point put it this way to the BBC: attackers "no longer need the keys to the vault."
For anyone who manages servers, pipelines, or services that sign something (payments, deployments, tokens), the lessons are the usual ones, but with a $6.3 billion price tag:
- The DevOps laptop is part of the critical infrastructure. If from there you can reach a container that signs transactions, your perimeter is in a backpack.
- A signing service needs its own rules: limits by amount and by time, destination allowlists, and alerts when a weird signature shows up. An EIP-7702 authorization doesn't fix a recipient or an amount: it hands another piece of code control over everything in the wallet and over whatever arrives later.
- Detecting fast is worth more than SAFU. Four hours of active delegation were four hours of lost deposits.
If you have funds on Binance: withdrawals are still paused and the company asks you to use only its official channels for news. The post-mortem is still pending, and that's what's really worth reading.