{"id":10260,"date":"2026-11-02T12:32:28","date_gmt":"2026-11-02T12:32:28","guid":{"rendered":"https:\/\/cybersecurityinfocus.com\/?p=10260"},"modified":"2026-11-02T12:32:28","modified_gmt":"2026-11-02T12:32:28","slug":"a-compromised-devops-laptop-caused-the-6-3b-binance-breach","status":"publish","type":"post","link":"https:\/\/cybersecurityinfocus.com\/?p=10260","title":{"rendered":"A compromised DevOps laptop caused the $6.3B Binance breach"},"content":{"rendered":"
\n
\n
\n
\n
<\/div>\n

Cryptocurrency Exchange Binance blamed a compromised DevOps laptop for the loss of $6.3 billion in cryptocurrency last week, adding that it will now cover any losses faced by its customers.<\/p>\n

\u201cBinance will cover all losses from the Secure Assets Fund for Users (SAFU) and the company\u2019s funds,\u201d the world\u2019s largest cryptocurrency exchange said<\/a> in an update on Friday, adding that user funds are safe and that it had found no evidence of wallet private-key leakage during its investigation of the incident. It had frozen approximately $3 billion in assets on-chain, temporarily suspending withdrawals while security checks were completed, and revoking the affected address authorization.<\/p>\n

Withdrawals are now being restored in phases, initially reopening services across 15 networks, including Bitcoin, Ethereum, Solana, and XRP. Binance says it has replenished approximately 95% of the affected assets using company funds, while the remaining 5%, comprising less-liquid tokens, could take longer to source.<\/p>\n

The exchange said its preliminary investigation pointed to a compromised employee device that enabled access to a service container involved in withdrawals.<\/p>\n

\u201cThis attack, reportedly on a development engineer, highlights that security is a critical element of every operational stage and personnel level,\u201d said Tim Rawlins<\/a>, senior advisor and director of security at NCC Group. \u201cWhen security failures in trusted identities and administrative access can be targeted, attackers can exploit more than just the underlying technical vulnerabilities.\u201d<\/p>\n

The FBI has since attributed<\/a> the attack to North Korean threat actors, identifying the TraderTraitor <\/a>hacking group as responsible for the theft.<\/p>\n

\u201cGiven what we know about the activities of countries like North Korea in targeting cryptocurrency, it\u2019s unsurprising that attackers are prepared to invest considerable efforts in targeting individuals who have access to the building blocks of the exchanges,\u201d Rawlins said.<\/p>\n

<\/a>A compromised laptop reaches the withdrawal pipeline<\/h2>\n

Binance\u2019s preliminary findings suggest that attackers compromised a DevOps engineer\u2019s laptop before gaining access to a service container and submitting unauthorized withdrawals. The exchange has yet to publish technical details of the attack, leaving important questions about the precise intrusion path and how the attackers navigated its internal systems.<\/p>\n

\u201cA platform holding digital assets should have multiple layers of security to prevent a single compromise, such as an employee\u2019s laptop being hacked, from being sufficient to authorize a transfer,\u201d said Mario Rivas<\/a>, blockchain and digital assets security lead at NCC Group.<\/p>\n

The reported attack is similar to the February 2025 Bybit breach<\/a>, in which attackers compromised a developer\u2019s machine at Safe{Wallet} and manipulated the interface presented to transaction signers. However, the Binance incident involved a different mechanism.<\/p>\n

F6\u2019s Threat Intelligence Department (TID) said the Binance attack reportedly targeted an automated withdrawal process rather than directly deceiving authorized signers. Evgeniy Yanov<\/a>, Head of Audit and Consulting Department at F6, cited Crypto security platform Blockaid, highlighting a batch of 50 EIP-7702<\/a> authorizations within a single transaction, alongside delegation to a malicious \u201csweeper\u201d contract, as an unusual feature of the reported attack.<\/p>\n

\u201cThis specific mechanism has not been seen before in large-scale breaches of this size,\u201d Yanov said.<\/p>\n

<\/a>FBI points to North Korea\u2019s TraderTraitor operation<\/h2>\n

The FBI has attributed the attack to TraderTraitor, an elite North Korean hacking unit considered part of the broader Lazarus<\/a> infrastructure.<\/p>\n

The agency, working with the US Secret Service and IRS Criminal Investigation, said it had observed the attackers converting stolen assets privately into Ethereum. It warned that the funds could subsequently be laundered through decentralized finance platforms and instant-swap services.<\/p>\n

F6\u2019s TID said the attribution was based on a combination of on-chain and off-chain intelligence. \u201cThe group\u2019s signature matches previous thefts: small Tornado Cash withdrawals used to fund the operator\u2019s wallet, extensive preparation well before the actual heist, and pre-signed transactions executed in a single burst,\u201d it added.<\/p>\n

TID researchers noted similarities with previous North Korean-linked cryptocurrency thefts, including the Bybit and KelpDAO incidents. However, they cautioned that Binance has not independently named the perpetrators and that the full attribution evidence has not been published.<\/p>\n

Binance did not immediately respond to a request for comment.<\/p>\n

NCC Group\u2019s Rawlins noted that the growing use of AI could help attackers chain vulnerabilities and operational weaknesses together, while organizations increasingly face adversaries willing to invest considerable effort when the potential financial return is substantial. \u201cGood cyber hygiene and effective security fundamentals are key to defending against attacks that many organizations are still missing,\u201d he said.<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>","protected":false},"excerpt":{"rendered":"

Cryptocurrency Exchange Binance blamed a compromised DevOps laptop for the loss of $6.3 billion in cryptocurrency last week, adding that it will now cover any losses faced by its customers. \u201cBinance will cover all losses from the Secure Assets Fund for Users (SAFU) and the company\u2019s funds,\u201d the world\u2019s largest cryptocurrency exchange said in an […]<\/p>\n","protected":false},"author":0,"featured_media":10261,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-10260","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-education"],"_links":{"self":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/10260"}],"collection":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=10260"}],"version-history":[{"count":0,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/10260\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/media\/10261"}],"wp:attachment":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=10260"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=10260"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=10260"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}