Binance says its hot wallets were compromised at about 20:05 UTC on Oct 29, with roughly $6.3B in tokens taken through unauthorized withdrawals; it first pointed to a compromised DevOps engineer's laptop that reached a service container, then said it found additional points of breach. About $3B was frozen on-chain with Tether, Circle, Ripple and others. Chainalysis and TRM Labs attribute it to North Korea's TraderTraitor. Binance says no private keys leaked, users will be made whole from SAFU and company funds, and by Oct 31 it had replenished 90% (100% for the top ten tokens). Likely the largest crypto theft on record.
What to do: Nov 2: FBI confirms North Korea's TraderTraitor; THN puts it at $6.43B with $2.85B frozen; FBI flagged 600+ addresses. Withdrawals reopened; about $5.1B left Binance in 24 hours, mostly to self-custody. Reuters Japan: 90% replenished.
Binance's initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions. We have found no evidence o
Investigation update: Our initial investigation suggested that the security incident may have involved a compromised laptop, however our subsequent investigation has uncovered additional points of breach. This was a complex attack, and we are doing all we ca
Blockchain analytics firms say they believe North Korean hackers are behind a $6.3 billion cryptocurrency heist that caused Binance to suspend deposits and withdrawals late Thursday
$6 Billion Binance Hack Bears Hallmarks of North Korea’s TraderTraitor
Why this score
Plan rubric with caps (verified sweep, Oct 31)