A Compromised DevOps Laptop Led to Binance's $6.36 Billion Theft, Most of It Gone in 20 Minutes

Most security programs are built around protecting the crown jewels: the keys, the vaults, the production database. Binance's breach on October 29 is a reminder of how little that helps when the attacker never touches the jewels directly. The exchange says it has found no sign that a wallet private key leaked. Instead, it traces the largest crypto theft ever recorded to a single DevOps engineer's laptop, and to a chain of access that ran from that endpoint into a service container able to submit withdrawal transactions. The signing system, in other words, worked exactly as designed. It just took instructions from the wrong person.

A Laptop, a Container and Ten Blockchains

According to BleepingComputer, Binance linked the theft to the engineer's compromised device, which let attackers reach a service container and push unauthorized withdrawals. Co-CEO Richard Teng was careful about what that does and does not mean, saying the attacker "did not simply use one engineer's permissions," that this "was not a single 'one-click' action," and that the investigation has not attributed responsibility to any individual. Binance also said it had "uncovered additional points of breach" and was still gathering facts. It has suspended deposits and withdrawals for security checks, revoked authorizations for the affected address, and says it will cover all losses from its SAFU fund and company money.

The scale came into view slowly. On the evening of October 29, BleepingComputer reported that Binance was only investigating "a potential security issue," while Arkham Intelligence was already tracking 55 addresses holding about $5.78 billion under the label binance-hacker-1029. A hot wallet called Binance 14 had reportedly moved about $2.53 billion across 64 tokens, and a second Binance wallet moved $174.4 million just 24 seconds later. Tether and Circle had frozen more than $2.3 billion before Binance had confirmed anything at all.

Staged a Day Early, Executed in Minutes

The timeline published by TRM Labs shows how little of this was improvised. On the morning of October 28, three small Tornado Cash withdrawals funded the operator wallet. Early on October 29 the attack code was deployed and tested on two wallets, the final version was rehearsed on a third, and about four hours later it was installed on a Binance hot wallet. At 20:05 UTC five XRP wallets sent 233.46 million XRP to a single address. Solana and Optimism followed, then 18,270 BTC left a Bitcoin hot wallet at 20:20, and within two minutes a Tron hot wallet sent 612.7 million USDT and 46.4 million TRX.

The Ethereum takeover is the part treasury and platform teams should study. At 20:20 the operator submitted 50 pre-signed EIP-7702 authorizations, a feature added in May 2025 that lets a wallet delegate its behaviour to a smart contract. Because each authorization is tied to a transaction nonce, signing 50 consecutive ones guaranteed one would be valid when it landed. About 3 minutes 24 seconds later the entire Ethereum hot wallet balance, including 167,464 ETH and 1.615 billion USDT, had been swept, and because the delegation stayed live, further sweeps followed until 23:56. TRM attributes the operation with high confidence to TraderTraitor, the North Korean unit the FBI named for the Bybit theft, and assesses the likeliest cause as a compromise of Binance's hot wallet signing infrastructure, since wallets on nine chains were drained through ordinary signed transfers.

The Freezes Worked, Partly, and the Lesson Is Upstream

The recovery effort was unusually fast. TRM counts about $2.7 billion frozen or moved out of reach by 00:30 UTC: roughly $1.77 billion in USDT by Tether, about $825 million in USDC by Circle in coordination with law enforcement, 40.5 million RLUSD by Ripple, 27.8 million USD1 by World Liberty Financial, and 8,426 ETH and 74.6 million ARB by the Arbitrum Security Council. The attacker raced those freezes, selling about 325 million USDT for around 122,300 ETH at roughly 10% below market and borrowing ETH against USDT on Aave and JustLend. More than 420,000 ETH and 18,270 BTC, about $2.4 billion, sit beyond any issuer's power to freeze.

None of that changes where the incident started. Freezes are a property of stablecoins, not of most enterprise systems, and most organizations will never have a Tether to call. What they do have is the same structure Binance had: engineers whose laptops hold credentials into build and production environments, services trusted to sign or approve high-value actions, and monitoring that watches the vault more closely than the path to it. Rehearsals on three wallets and a funded operator wallet a day ahead were all visible signals before 20:05. The theft itself took minutes; the window to stop it was hours.

What to Do This Week

• Map every path from an engineer's laptop to production. List which endpoints can reach containers, CI runners or services that sign, approve or move money, and treat those laptops as privileged infrastructure rather than ordinary user devices.
• Make signing services refuse the unusual. TRM advises rejecting unexpected EIP-7702 authorizations and treating requests for many authorizations across a nonce range as a compromise indicator. The general rule is that a signer should block bulk or out-of-pattern requests, not just verify credentials.
• Separate approval paths by tier. Follow TRM's recommendation to split signing infrastructure and approval paths by chain and wallet tier, so one compromised service cannot empty every account at once.
• Alert on staging, not just on theft. Code deployed to new workloads, test transactions against production systems and new delegations are all pre-attack signals. Make sure someone is watching for them around the clock, not only during business hours.
• Keep a tested way to revoke. TRM tells treasury teams to keep a tested method for signing revocations. Every high-value system needs a rehearsed kill switch that does not depend on the infrastructure that may be compromised.
• Red team the developer route. Commission an exercise that starts from a compromised engineering laptop and measures how far it gets before anyone notices, then fix what that reveals.

Binance can absorb this loss, and the freezes clawed back a large share of it. Most organizations would not be so lucky, and most do not hold assets a stablecoin issuer can lock. The more useful takeaway is that the world's largest exchange lost $6.36 billion without losing a key, because a trusted endpoint gave a patient attacker a seat inside the process that uses the keys. That is a design pattern, not a crypto problem, and it is worth checking for in your own environment.