Binance says a compromised DevOps engineer’s laptop may have enabled an attacker to submit unauthorized withdrawals in a security incident with an estimated impact of $6.3 billion.
The cryptocurrency exchange says it has frozen approximately $3 billion in affected assets on-chain and pledged to cover all losses.
Withdrawals remain suspended while Binance overhauls its withdrawal service and related addresses. In its latest service update, the company said deposits are operating normally and that it expects withdrawals to resume within 48 hours.
Preliminary findings, disclosed on October 30, suggest the attacker accessed a service container through the engineer’s compromised computer. Binance said it has found no evidence that wallet private keys were leaked.
TRM Labs has attributed the attack to TraderTraitor, a North Korean state-sponsored hacking group, with high confidence based on on-chain and off-chain intelligence. The blockchain intelligence firm says the group was also responsible for the $1.5 billion Bybit hack in February 2025.
Binance operates a cryptocurrency exchange where customers buy, sell, and hold digital assets. The incident has disrupted customers’ ability to move funds out of the platform while the company investigates how unauthorized transactions passed through its withdrawal infrastructure.
Compromised computer under investigation
The company’s initial account points to an intrusion involving the infrastructure used to process withdrawals. A service container is an isolated environment used to run software, although Binance has not yet described the affected container’s specific role or the permissions available to the attacker.
In its subsequent update, Binance said multiple factors contributed to the incident and that its security team is tracing the full attack path through the compromised computer, which may have been the entry point.
The exchange has not disclosed how the laptop was compromised, how it gained access to the container, or which controls failed to prevent the transactions. It plans to release a detailed technical post-mortem once investigators have established and verified the facts.
As part of its immediate response, Binance revoked authorization for the affected address and engaged law enforcement and blockchain intelligence partners to trace and recover assets.
Billions frozen as withdrawals remain paused
Binance said it is working with token issuers, blockchain intelligence firms, law enforcement agencies, and other industry partners to identify and freeze additional assets. Its latest verified frozen total is approximately $3 billion.
That figure describes assets frozen on-chain and should not be treated as an amount already returned to the exchange. Binance has not provided a final recovery total.
The company says it will cover losses with its SAFU fund and corporate funds and has repeatedly assured customers their funds are safe. It also plans to publish an updated Proof of Reserves after remediation is complete.
Earlier announcements described a precautionary suspension of both deposits and withdrawals. The latest update clarifies that deposits are functioning normally, while withdrawals remain paused pending security work. The stated 48-hour resumption window remains an estimate.
Customers should check Binance’s official announcements for service updates and use its established support channels for account questions. Avoid unsolicited recovery offers or messages asking for account credentials, private keys, or payments to unlock withdrawals.
Leave a Reply