WiretechnologyDextape brief
Binance Says a Compromised Engineer’s Laptop May Have Opened the $6.3B Drain; No Evidence of Leaked Keys
Binance's preliminary account says a compromised DevOps engineer's laptop may have let an attacker submit unauthorized withdrawals, and the exchange found no evidence of a private key leak. Withdrawals stay paused and two blockchain intelligence firms point to North Korea.
Dextape brief
Binance says a compromised laptop belonging to a DevOps engineer, not leaked wallet keys, provided the entry point for the drain. Its October 30 Security Incident Update states the intruder reached a service container from inside and sent unauthorized withdrawals. The exchange's preliminary, unaudited estimate of total impact is about $6.3 billion, with roughly $3 billion frozen on-chain. TRM Labs puts the take near $6.36 billion and links the attack to North Korea's TraderTraitor unit with high confidence; Chainalysis reports roughly $6.4 billion. Both are private-firm assessments, not government findings. Withdrawals stay paused during security checks, deposits run normally, and user losses will be covered by the SAFU fund and company money. Binance plans a detailed post-mortem and updated Proof of Reserves after verification.
Why it matters: It shows how a compromised staff device, rather than stolen keys, can expose exchange funds, a relevant lesson for custody security across crypto platforms.
Read the full story
Dextape context
Built from Dextape’s own wire, stories and glossary.
Terms in this story
- Private key
- The secret number that signs transactions for an address.
- Blockchain
- A shared, ordered record of transactions, grouped into blocks, that independent computers check against the same protocol rules.