Breaches

Binance loses record $6.3bn in heist tied to North Korea

Binance says $6.3bn was drained from hot wallets via a compromised engineer laptop. Analysts blame North Korea’s TraderTraitor. What UK firms should do.

Padlock graphic with the headline Binance loses record $6.3bn to hackers

Binance says attackers took roughly $6.3bn from its hot wallets on Thursday evening, the largest crypto theft ever recorded, and blockchain analysts blame North Korea. The way in appears to have been an engineer’s laptop, which is why every UK organisation that runs privileged systems should pay attention, not just crypto firms.

What happened

Shortly after 20:00 GMT on Thursday 29 October 2026, funds started flowing out of Binance hot wallets across about ten chains, among them Ethereum, Bitcoin, Tron, Solana and the XRP Ledger, with most of it gone inside 20 minutes. TRM Labs puts the total at about $6.36bn, Elliptic at $6.43bn and Chainalysis at roughly $6.4bn. Binance’s own estimate is $6.3bn and it has warned the figure may rise. That is roughly four times Bybit’s $1.5bn loss in February 2025, the previous record.

Binance suspended deposits and withdrawals on Thursday night and has promised to make users whole using its SAFU emergency fund plus its own capital. Insurance Business UK values SAFU at about $1bn to $1.2bn, so the balance sheet will carry most of the cost. On Friday the exchange said it expected withdrawals to restart within about 45 hours, once its withdrawal service and related addresses had been rebuilt.

Stablecoin issuers moved quickly. Tether and Circle froze more than 1.5 billion USDT and 800 million USDC between them. By Friday, about $2.8bn to $3bn was frozen, depending on whose count you use. Elliptic estimates the attacker still controls about $3.3bn that no issuer can freeze, largely ether and bitcoin; TRM Labs puts the ether and bitcoin holding at about $2.4bn.

TRM Labs and Chainalysis both pin the heist, with high confidence, on TraderTraitor, the Lazarus-linked North Korean unit the FBI blamed for Bybit. Chainalysis says it watched Binance proceeds mix in real time with funds from September’s Bitget theft, which has already been attributed to North Korea. Elliptic also leans towards North Korea but urges caution, because the laundering was slower and used different methods from previous North Korean operations. Binance co-CEO Richard Teng says its investigation has not attributed responsibility to any individual.

The technical picture

Binance first said the intrusion appears to have started on a DevOps engineer’s compromised laptop. From there the attacker reached a service container and submitted withdrawal requests the exchange had not authorised. On Friday, Binance added that it had found “additional points of breach”. Teng stressed this was a multi-stage operation, not one engineer’s permissions being reused. The exchange reports no sign that any wallet private key leaked, a claim at least one outside commentator quoted by Reuters disputes.

The on-chain evidence suggests why the keys may not have mattered. On Ethereum, TRM Labs describes the attacker using EIP-7702 delegations, introduced with the Pectra upgrade. The attacker submitted 50 pre-signed authorisations, one per consecutive transaction count, so one would still be valid on a busy hot wallet, then used the resulting delegation to empty it: over 167,000 ETH and 1.6 billion USDT in a single sweep. Elsewhere, the wallets made ordinary-looking signed transfers.

Both TRM Labs and Elliptic reach the same conclusion. The attacker seems to have gained the ability to make Binance’s own signing systems approve transactions of the attacker’s choosing. The cryptography was not broken. Elliptic compares it directly with Bybit, where a wallet supplier’s developer machine was the way in. Preparation was deliberate: TRM Labs traced Tornado Cash funding at least 36 hours beforehand and test runs hours before the theft.

The attacker then raced the freezes, dumping USDT to market makers at a steep discount and borrowing against stablecoins, while Chainalysis reports a new, heavily automated laundering pattern.

Timeline of the Binance heist from attacker preparation and laptop compromise to the wallet drain, fund freezes and planned withdrawal restart

Why it matters for UK organisations

The direct UK link is real, but its size is unknown. According to Insurance Business UK, the FCA barred Binance’s UK entity from regulated activity in 2021, and the exchange closed its doors to new UK sign-ups in October 2023 while existing accounts kept trading. Binance has not said how many UK users are caught up in the freeze. The FCA’s new cryptoasset regime is part-way through its authorisation window, which closes on 28 February 2027, ahead of go-live on 25 October 2027. With senior managers regime accountability attached, this incident will feature in every crypto board’s custody discussion.

London’s insurance market is exposed too. Lloyd’s standalone cyber policies written since 31 March 2023 must exclude certain state-backed attacks, so official attribution to North Korea will send claims teams to their wordings, though whether a private exchange theft meets that bar is arguable.

The broader lesson applies to every UK organisation. You do not need to hold crypto to have something that one engineer’s laptop can reach. Payment runs, CI/CD pipelines and cloud consoles all qualify.

Expert view

Strip away the blockchain detail and this is a familiar intrusion. North Korean operators have a long record of targeting individual staff with fake job offers, coding tests and poisoned projects. In my experience, developer and DevOps workstations are the weakest point in many otherwise mature environments. They hold standing credentials, run unvetted packages and often escape normal desktop controls.

The design question is the one that worries me. If a compromised workstation can reach a service that gets signatures issued, the protection around the keys matters far less than you think. When we test payment and signing workflows, the findings that matter are rarely about key storage. They are about who or what can ask the signer to act, and whether anything independent checks the request before it goes through. With no root cause published and more breach points already admitted, I would not assume the full chain is known.

One positive: freezing around $3bn within hours shows what fast, coordinated intelligence sharing can achieve.

What to do now

  1. Treat engineer endpoints as privileged assets. Use separate, hardened admin workstations for production access, keep software installation tightly controlled and run EDR on them. This maps to the Cyber Essentials secure configuration and malware protection controls.
  2. Remove standing access to high-value services. Use just-in-time elevation, phishing-resistant MFA and short-lived credentials for anything that can move money or sign transactions (Cyber Essentials user access control).
  3. Put independent checks in front of signing and payment systems. Enforce policy limits, require approval from more than one person and detect anomalies the requester cannot switch off. Monitor for unexpected delegations or authorisations.
  4. Brief staff about recruitment-themed lures. Unsolicited job offers, coding challenges and repositories sent to engineers are a known North Korean entry route.
  5. Check third-party custody exposure. If treasury or operating funds sit on an exchange, confirm how long you could cope with a frozen balance. Check your policies’ state-backed exclusions.
  6. Screen inbound crypto. UK firms that accept digital assets should screen deposits against the published labels for this incident.

Bottom line

A record $6.3bn theft appears to trace back to one compromised laptop and a signing system that did what it was asked. North Korea is the prime suspect and nearly half the money is frozen, but the root cause is still unconfirmed. UK organisations do not need to wait for Binance’s report to check whether their own most privileged systems are one compromised laptop away from the same outcome.

Sources

Related Posts