{"id":750456,"date":"2026-10-30T12:45:27","date_gmt":"2026-10-30T09:45:27","guid":{"rendered":"https:\/\/buradabiliyorum.com\/en\/binance-says-its-6-3bn-hack-involved-more-than-a-compromised-laptop\/"},"modified":"2026-10-30T12:45:27","modified_gmt":"2026-10-30T09:45:27","slug":"binance-says-its-6-3bn-hack-involved-more-than-a-compromised-laptop","status":"publish","type":"post","link":"https:\/\/buradabiliyorum.com\/en\/binance-says-its-6-3bn-hack-involved-more-than-a-compromised-laptop\/","title":{"rendered":"Binance says its $6.3bn hack involved more than a compromised laptop"},"content":{"rendered":"<div id=\"ez-toc-container\" class=\"ez-toc-v2_0_89 counter-hierarchy ez-toc-counter ez-toc-custom ez-toc-container-direction\">\n<p class=\"ez-toc-title\" style=\"cursor:inherit\">Table of Contents<\/p>\n<label for=\"ez-toc-cssicon-toggle-item-6aee3d7698893\" class=\"ez-toc-cssicon-toggle-label\"><span class=\"\"><span class=\"eztoc-hide\" style=\"display:none;\">Toggle<\/span><span class=\"ez-toc-icon-toggle-span\"><svg style=\"fill: #dd3333;color:#dd3333\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" class=\"list-377408\" width=\"20px\" height=\"20px\" viewBox=\"0 0 24 24\" fill=\"none\"><path d=\"M6 6H4v2h2V6zm14 0H8v2h12V6zM4 11h2v2H4v-2zm16 0H8v2h12v-2zM4 16h2v2H4v-2zm16 0H8v2h12v-2z\" fill=\"currentColor\"><\/path><\/svg><svg style=\"fill: #dd3333;color:#dd3333\" class=\"arrow-unsorted-368013\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"10px\" height=\"10px\" viewBox=\"0 0 24 24\" version=\"1.2\" baseProfile=\"tiny\"><path d=\"M18.2 9.3l-6.2-6.3-6.2 6.3c-.2.2-.3.4-.3.7s.1.5.3.7c.2.2.4.3.7.3h11c.3 0 .5-.1.7-.3.2-.2.3-.5.3-.7s-.1-.5-.3-.7zM5.8 14.7l6.2 6.3 6.2-6.3c.2-.2.3-.5.3-.7s-.1-.5-.3-.7c-.2-.2-.4-.3-.7-.3h-11c-.3 0-.5.1-.7.3-.2.2-.3.5-.3.7s.1.5.3.7z\"\/><\/svg><\/span><\/span><\/label><input type=\"checkbox\"  id=\"ez-toc-cssicon-toggle-item-6aee3d7698893\" checked aria-label=\"Toggle\" \/><nav><ul class='ez-toc-list ez-toc-list-level-1 ' ><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-1\" href=\"https:\/\/buradabiliyorum.com\/en\/binance-says-its-6-3bn-hack-involved-more-than-a-compromised-laptop\/#Twenty_minutes_on_ten_blockchains\" >Twenty minutes on ten blockchains<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-2\" href=\"https:\/\/buradabiliyorum.com\/en\/binance-says-its-6-3bn-hack-involved-more-than-a-compromised-laptop\/#The_freezes\" >The freezes<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-3\" href=\"https:\/\/buradabiliyorum.com\/en\/binance-says-its-6-3bn-hack-involved-more-than-a-compromised-laptop\/#Who_is_blamed_and_who_denies_it\" >Who is blamed, and who denies it<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-4\" href=\"https:\/\/buradabiliyorum.com\/en\/binance-says-its-6-3bn-hack-involved-more-than-a-compromised-laptop\/#What_happens_next\" >What happens next<\/a><\/li><\/ul><\/nav><\/div>\n<p><img decoding=\"async\" src=\"https:\/\/media.thenextweb.com\/2026\/10\/binance-logo-yellow-diamond-pattern.avif\" \/><\/p>\n<div id=\"article-main-content\">\n<p>Binance now says a compromised laptop was not the only way in. Its investigation has \u201cuncovered additional points of breach\u201d in the attack that hit about $6.3bn of its assets on Thursday, the world\u2019s largest crypto exchange said on Friday.<\/p>\n<p>Binance said in an <a rel=\"nofollow\" target=\"_blank\" href=\"https:\/\/x.com\/binance\/status\/2116089661408108712\" target=\"_blank\" rel=\"nofollow noopener\">investigation update<\/a> on X that it will cover all losses and has frozen about $3bn so far. Blockchain analytics firm TRM Labs puts the theft at $6.36bn in a <a rel=\"nofollow\" target=\"_blank\" href=\"https:\/\/www.trmlabs.com\/resources\/blog\/north-korea-steals-usd-6-36-billion-from-binance-in-the-largest-hack-in-history\" target=\"_blank\" rel=\"nofollow noopener\">report<\/a> on the Binance hack. It calls it \u201cthe largest crypto theft on record\u201d and attributes it to TraderTraitor, a North Korean state hacking unit. The previous record was the $1.5bn taken from rival exchange Bybit in February 2025.<\/p>\n<blockquote>\n<p>\u201cOur initial investigation suggested that the security incident may have involved a compromised laptop, however our subsequent investigation has uncovered additional points of breach,\u201d Binance said.<\/p>\n<\/blockquote>\n<p>Its <a rel=\"nofollow\" target=\"_blank\" href=\"https:\/\/x.com\/binance\/status\/2115993361517891592\" target=\"_blank\" rel=\"nofollow noopener\">first update<\/a>, on Thursday night, said a compromised DevOps engineer\u2019s laptop may have let an attacker into a service container to submit unauthorised withdrawals. A later service update said the incident \u201cstems from multiple factors\u201d, with the compromised computer a possible entry point. A root-cause report will follow, Binance said.<\/p>\n<p>Binance said it has found no evidence of any wallet private key leak. It will cover the losses from its Secure Asset Fund for Users (SAFU), an emergency reserve, and from company funds.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"Twenty_minutes_on_ten_blockchains\"><\/span>Twenty minutes on ten blockchains<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>The money started leaving Binance wallets at 20:05 UTC on 29 October, according to TRM. Most of it moved in about 20 minutes, across ten blockchains including Ethereum, Bitcoin, Tron, Solana and the XRP Ledger. A second wave hit wallets on Avalanche and Polygon around 23:05 UTC.<\/p>\n<p>Preparation began at least 36 hours earlier, TRM said. The attacker funded a wallet with small withdrawals from Tornado Cash, a service that hides where crypto comes from. It then rehearsed the attack on test wallets.<\/p>\n<p>On Ethereum, the attacker used a feature called EIP-7702 to hand control of a Binance \u201chot wallet\u201d to its own code. A hot wallet is one an exchange keeps online to pay out customer withdrawals. One transaction then moved 167,464 ETH and 63 other tokens, including 1.615 billion USDT, TRM said.<\/p>\n<p>Wallets on the other chains sent funds through ordinary signed transfers in the same half hour. In TRM\u2019s assessment, that points to an attacker who could make Binance\u2019s signing system <a href=\"https:\/\/buradabiliyorum.com\/en\/category\/download-scripts-themes-apps\/\" data-internallinksmanager029f6b8e52c=\"9\" title=\"Download Scripts &amp; Themes &amp; Apps\" target=\"_blank\" rel=\"noopener\">app<\/a>rove transactions on many chains. \u201cBinance has yet to publish a root cause,\u201d TRM wrote.<\/p>\n<p>Binance co-CEO Richard Teng said the attack was not a matter of one person\u2019s access.<\/p>\n<blockquote>\n<p>\u201cTo be clear: the attacker did not simply use one engineer\u2019s permissions, and this was not a single \u2018one-click\u2019 action,\u201d Teng <a rel=\"nofollow\" target=\"_blank\" href=\"https:\/\/x.com\/_RichardTeng\/status\/2116072080525656150\" target=\"_blank\" rel=\"nofollow noopener\">wrote on X<\/a>.<\/p>\n<\/blockquote>\n<p>He said the investigation has not attributed responsibility to any individual.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"The_freezes\"><\/span>The freezes<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Stablecoin issuers, which can block their own tokens, froze stolen funds within the hour. Tether froze 971.1 million USDT at 21:01 UTC, according to TRM. Circle froze 823 million USDC three minutes later. Ripple, World Liberty Financial and the Arbitrum network\u2019s Security Council also froze funds.<\/p>\n<p>TRM counted about $2.7bn frozen on-chain by 00:30 UTC on Friday. Binance\u2019s figure is about $3bn. The attacker still holds more than 420,000 ETH and 18,270 BTC, about $2.4bn that no issuer can freeze, TRM said.<\/p>\n<p>Before the freezes spread, the attacker sold about 325 million USDT for ETH at a discount of more than 10%, TRM said. It also borrowed ETH against USDT on the lending protocol Aave. Aave then froze the affected markets. The outflows stopped when Binance paused withdrawals, the exchange said.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"Who_is_blamed_and_who_denies_it\"><\/span>Who is blamed, and who denies it<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>TRM said it makes its North Korea judgment \u201cwith high confidence\u201d, based on on-chain and off-chain intelligence. The FBI named the same group as behind the Bybit theft, TRM noted. <a rel=\"nofollow\" target=\"_blank\" href=\"https:\/\/x.com\/chainalysis\/status\/2115963516884808078\" target=\"_blank\" rel=\"nofollow noopener\">Chainalysis<\/a>, another analytics firm, also tied the attack to the group and estimated $5.912bn stolen at the time of the theft.<\/p>\n<p>Binance has not named a culprit. North Korea has denied involvement in hacks in the past, Osmond Chia reported for the <a rel=\"nofollow\" target=\"_blank\" href=\"https:\/\/www.bbc.com\/news\/articles\/cwg7xp8kx4v5o\" target=\"_blank\" rel=\"nofollow noopener\">BBC<\/a>. In September, Bitget said it suspected North Korean hackers in the Bitget hack of its hot wallets. This month, the US charged 14 people over a scheme placing North Korean IT workers at more than 70 companies. The country\u2019s hackers are also building their own AI tools.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"What_happens_next\"><\/span>What happens next<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Binance suspended deposits and withdrawals on Thursday night. By Friday, it said deposits were operating normally. It is on track to resume withdrawals within 45 hours of its latest update, after a security revamp of its withdrawal service. Binance.US, a separate company, said it was not affected.<\/p>\n<p>Bitcoin fell below $77,000 for the first time in more than a month on the <a href=\"https:\/\/buradabiliyorum.com\/en\/category\/news\/\" data-internallinksmanager029f6b8e52c=\"2\" title=\"News\" target=\"_blank\" rel=\"noopener\">news<\/a>, Muyao Shen and Vildana Hajric reported for <a rel=\"nofollow\" target=\"_blank\" href=\"https:\/\/www.bloomberg.com\/news\/articles\/2026-10-29\/binance-founder-says-possible-hack-of-exchange-bitcoin-falls\" target=\"_blank\" rel=\"nofollow noopener\">Bloomberg<\/a>. Binance said it will publish a technical post-mortem and an updated proof of reserves once its investigation is complete.<\/p>\n<\/p><\/div>\n<blockquote><p><strong><span style=\"color: #ff6600;\">If you liked the article, do not forget to share it with your friends. Follow us on\u00a0<span style=\"color: #ff0000;\"><a style=\"color: #ff0000;\" href=\"https:\/\/news.google.com\/publications\/CAAqBwgKMN63nwsw68G3Aw\" target=\"_blank\" rel=\"nofollow noopener noreferrer\">Google News<\/a><\/span>\u00a0too, click on the star and choose us from your favorites.<\/span><\/strong><\/p><\/blockquote>\n<blockquote>\n<p style=\"text-align: center;\"><strong>If you want to read more like this article, you can visit our <span style=\"color: #ff9900;\"><a style=\"color: #ff9900;\" href=\"https:\/\/buradabiliyorum.com\/en\/category\/technology\/\" target=\"_blank\" >Technology category.<\/a><\/span><\/strong><\/p>\n<\/blockquote>\n<p><span style=\"color: black;\"><a style=\"color: #ff9900;\" href=\"https:\/\/thenextweb.com\/news\/binance-hack-6-3bn-north-korea-tradertraitor\" target=\"_blank\" >Source<\/a><\/span><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Binance now says a compromised laptop was not the only way in. Its investigation has \u201cuncovered additional points of breach\u201d in the attack that hit about $6.3bn of its assets on Thursday, the world\u2019s largest crypto exchange said on Friday. Binance said in an investigation update on X that it will cover all losses and&#8230;<\/p>\n","protected":false},"author":1,"featured_media":750457,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"fifu_image_url":"https:\/\/media.thenextweb.com\/2026\/10\/binance-logo-yellow-diamond-pattern.jpg","fifu_image_alt":"","footnotes":""},"categories":[18],"tags":[],"class_list":["post-750456","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-technology"],"_links":{"self":[{"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/posts\/750456","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/comments?post=750456"}],"version-history":[{"count":0,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/posts\/750456\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/media\/750457"}],"wp:attachment":[{"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/media?parent=750456"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/categories?post=750456"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/tags?post=750456"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}