Compromised DevOps engineer’s laptop may have provided entry point; investigators suspect North Korean hacking group TraderTraitor

Brussels, (Unib Rashid) – Binance, the world’s largest cryptocurrency exchange, is investigating a massive security breach involving the reported theft of approximately $6.3 billion in digital assets, in what could become one of the largest cryptocurrency thefts in history.

Initial findings suggest that hackers may have exploited a compromised laptop belonging to a DevOps engineer to gain access to Binance’s internal systems and execute unauthorised withdrawal transactions. However, the company has indicated that multiple security weaknesses may have contributed to the incident.

According to blockchain intelligence firm Bitquery, the attackers transferred funds from 17 Binance hot wallets within less than four hours, distributing the stolen assets across nine different blockchain networks, including Ethereum, Bitcoin and TRON.

The attack reportedly began on Thursday night and continued into the early hours of Friday. During this period, the hackers moved billions of dollars in cryptocurrency to newly created digital wallets.

Binance and its partners, including major stablecoin issuers, managed to freeze approximately $2.7 billion of the stolen assets. However, around $3.1 billion reportedly remained under the attackers’ control, primarily in Bitcoin and Ether.

Binance confirmed that it had temporarily suspended deposits and withdrawals while carrying out security checks. The company also revoked the affected address authorisations and began working with law enforcement agencies and blockchain intelligence specialists to trace and recover the funds.

The exchange has assured customers that it will cover all losses resulting from the incident. It has also pledged to publish a detailed technical report once the investigation is completed.

North Korean hacking group suspected

Meanwhile, blockchain intelligence and cybersecurity firm TRM Labs has attributed the attack to TraderTraitor, a hacking group linked to North Korea.

TRM Labs said its assessment was based on extensive on-chain and off-chain intelligence, expressing high confidence in the group’s involvement.

The same group has previously been linked by the FBI to the February 2025 Bybit cryptocurrency exchange hack, in which approximatly $1.5 billion was stolen.

Investigators are continuing to examine how the attackers penetrated Binance’s security systems and whether additional vulnerabilities or compromised access points played a role.

The incident has once again raised serious concerns about cybersecurity risks facing the global cryptocurrency industry, particularly as hackers increasingly exploit sophisticated techniques to target major digital asset platforms.