One engineer's laptop cost Binance $6.3 billion, and North Korea is the suspect

Binance has given its first account of how the money got out. According to the preliminary investigation, it started with a single compromised laptop belonging to a DevOps engineer. The attacker used it to get into a service container and push withdrawal requests nobody had approved. The exchange says it has found no sign that wallet private keys were exposed.

The scale is now official too. Binance puts the total impact at about $6.3 billion, more than four times the previous record, the $1.5 billion Bybit hack in 2025. Roughly $3 billion has already been frozen on chain with help from stablecoin issuers: Tether locked about $1.6 billion and Circle more than $800 million.

Overnight we reported that the exchange had paused withdrawals and acknowledged the incident. Now both deposits and withdrawals are halted and the affected addresses have lost their permissions. Binance promises to cover all losses from its SAFU insurance fund and company money, and to publish fresh proof of reserves and a detailed technical write-up once the checks are done.

There is a suspect as well. Analytics firms Chainalysis and TRM Labs link the attack to TraderTraitor, a North Korean group also blamed for the Bybit heist. Binance itself does not name North Korea and only says it is working with law enforcement. Bitcoin slid more than 4% on the news.

Bottom line: by the exchange's own account, the world's biggest crypto exchange was opened up through one employee's laptop.