--- title: Binance hack: how a developer laptop can put $6.3B in play description: Binance says the $6.3 billion hack may have started with a compromised DevOps engineer's laptop. That access reportedly let an attacker reach a service... canonical: https://daily.dev/posts/binance-hack-how-a-developer-laptop-can-put-6-3b-in-play-7cprtijyg twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Binance hack: how a developer laptop can put $6.3B in play | daily.dev og:description: Binance says the $6.3 billion hack may have started with a compromised DevOps engineer's laptop. That access reportedly let an attacker reach a service... og:url: https://daily.dev/posts/binance-hack-how-a-developer-laptop-can-put-6-3b-in-play-7cprtijyg og:image: https://api.daily.dev/og/posts/7CprtIjyg.png og:image:alt: Binance hack: how a developer laptop can put $6.3B in play og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Binance hack: how a developer laptop can put $6.3B in play **[Aikido Security](https://daily.dev/sources/aikido-security)** · 7 min read · 0 upvotes · 0 comments ## Summary Binance says the $6.3 billion hack may have started with a compromised DevOps engineer's laptop. That access reportedly let an attacker reach a service container and submit unauthorized withdrawal transactions. About $3 billion has been frozen on-chain, and Binance says it will cover all losses. A later update said investigators found additional points of breach beyond the laptop, with no further detail given. TRM Labs and Chainalysis attribute the attack to TraderTraitor, a North Korean hacking unit, though Binance hasn't confirmed this. Binance also says no wallet private key leak has been found so far. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Did the Binance hack involve stolen private keys? No, Binance says it has so far found no evidence of a wallet private key leak. An attacker can still move funds through a service that is already authorized to send withdrawals, without ever holding the keys themselves, by compromising the signing or approval infrastructure instead. _Developers securing crypto infrastructure follow breach analyses like this on daily.dev to harden signing flows._ ### How did the Binance $6.3 billion hack reportedly start? It may have started with a compromised DevOps engineer's laptop, according to Binance. That laptop access let an attacker reach a service container and submit unauthorized withdrawal transactions. A later Binance update said additional points of breach were found beyond the laptop, with about $3 billion frozen on-chain so far. _Engineers hardening developer device security track incidents like this on daily.dev._ ### Who is believed to be responsible for the Binance hack? Analysts at TRM Labs and Chainalysis attribute the attack to TraderTraitor, a North Korean hacking unit known for targeting developers through fake job interviews and malicious packages. Binance has not confirmed this attribution itself. _Teams assessing nation-state threats to crypto infrastructure follow attribution reports like this on daily.dev._ --- Tags: [#security](https://daily.dev/tags/security), [#cyber](https://daily.dev/tags/cyber), [#crypto](https://daily.dev/tags/crypto), [#malware](https://daily.dev/tags/malware) [View this post on daily.dev](https://daily.dev/posts/binance-hack-how-a-developer-laptop-can-put-6-3b-in-play-7cprtijyg) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Binance hack: how a developer laptop can put $6.3B in play","url":"https://daily.dev/posts/binance-hack-how-a-developer-laptop-can-put-6-3b-in-play-7cprtijyg","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/binance-hack-how-a-developer-laptop-can-put-6-3b-in-play-7cprtijyg"},"datePublished":"2026-10-30T13:35:09.123Z","dateModified":"2026-10-30T14:30:38.240Z","description":"Binance says the $6.3 billion hack may have started with a compromised DevOps engineer's laptop. That access reportedly let an attacker reach a service...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/936fb2565aec1f99c13faa8595984c80?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/936fb2565aec1f99c13faa8595984c80?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Aikido Security","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Aikido Security","logo":"https://media.daily.dev/image/upload/s--vJDqDYv_--/f_auto,q_auto/v1774959928/logos/aikido-security?_a=BAMAMiWQ0","url":"https://daily.dev/sources/aikido-security"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/binance-hack-how-a-developer-laptop-can-put-6-3b-in-play-7cprtijyg","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,cyber,crypto,malware","timeRequired":"PT7M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Aikido Security","item":"https://daily.dev/sources/aikido-security"},{"@type":"ListItem","position":3,"name":"Binance hack: how a developer laptop can put $6.3B in play"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/binance-hack-how-a-developer-laptop-can-put-6-3b-in-play-7cprtijyg#faq","mainEntity":[{"@type":"Question","name":"Did the Binance hack involve stolen private keys?","acceptedAnswer":{"@type":"Answer","text":"No, Binance says it has so far found no evidence of a wallet private key leak. An attacker can still move funds through a service that is already authorized to send withdrawals, without ever holding the keys themselves, by compromising the signing or approval infrastructure instead. Developers securing crypto infrastructure follow breach analyses like this on daily.dev to harden signing flows."}},{"@type":"Question","name":"How did the Binance $6.3 billion hack reportedly start?","acceptedAnswer":{"@type":"Answer","text":"It may have started with a compromised DevOps engineer's laptop, according to Binance. That laptop access let an attacker reach a service container and submit unauthorized withdrawal transactions. A later Binance update said additional points of breach were found beyond the laptop, with about $3 billion frozen on-chain so far. Engineers hardening developer device security track incidents like this on daily.dev."}},{"@type":"Question","name":"Who is believed to be responsible for the Binance hack?","acceptedAnswer":{"@type":"Answer","text":"Analysts at TRM Labs and Chainalysis attribute the attack to TraderTraitor, a North Korean hacking unit known for targeting developers through fake job interviews and malicious packages. Binance has not confirmed this attribution itself. Teams assessing nation-state threats to crypto infrastructure follow attribution reports like this on daily.dev."}}]} ```