Binance hit by a $6.3 billion hack after a DevOps laptop compromise, with North Korea suspected

Binance says it was the target of a “complex attack” that started with a compromised laptop tied to a DevOps engineer and ended with unauthorized withdrawals from a service container. For high-risk PSPs, the important part is not the headline number alone; it is the chain of custody failure, the speed of the withdrawals, and the fact that stablecoin issuers were able to freeze part of the flow.

1. Binance, described in the source as the world’s leading cryptocurrency exchange, said hackers infiltrated a systems development engineer’s laptop and gained permissions that allowed them to move close to US$ 6.3 billion in just a few hours. The source calls it the largest crypto theft on record. By comparison, the Byget theft in February 2025 was US$ 1.4 billion, four times smaller.
2. The company said its initial investigation points to a security incident around the laptop of a DevOps engineer. According to Binance, that compromise allowed an attacker to access a service container and carry out unauthorized withdrawal transactions. Binance later said its follow-up investigation found additional vulnerabilities and that it was working with authorities to resolve the case.
3. Binance did not name the source of the attack, but the sector is pointing to North Korea. TRM Labs, a blockchain intelligence firm focused on financial crime investigations, attributed the operation to the TraderTraitor group and said several elements matched earlier North Korean-linked thefts, including the Bybit hack and the KelpDAO incident in April 2026.
4. TRM Labs said the operation ran between 17:05 and 20:56 on Thursday in Argentina. During that window, code was executed that diverted funds entering Binance’s hot wallet, the wallet used to handle operations and withdrawals. In other words: this was not a smash-and-grab in one transaction, but a coordinated sequence that moved money as it flowed in.
5. Binance said it will cover all losses using SAFU (emergency funds) and company funds, and repeated that user funds are safe. In parallel, Tether, Circle, Ripple and World Liberty Financial froze US$ 2.670 billion in stablecoins tied to some of the stolen cryptoassets.

For PSPs and exchanges, the useful takeaway is straightforward: endpoint compromise, service-container access, and hot-wallet execution can turn an employee-device incident into a platform-level loss very quickly. The stablecoin freezes also show that recovery and containment can start after the theft, not just at the perimeter.