--- title: Crypto’s biggest heist exposes the weak link in exchange... description: Attackers stole $6.3 billion from Binance by compromising the system that authorizes wallet transactions, not by breaking encryption or stealing private keys.... canonical: https://daily.dev/posts/crypto-s-biggest-heist-exposes-the-weak-link-in-exchange-security-9wt3wyiyd twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Crypto’s biggest heist exposes the weak link in exchange security | daily.dev og:description: Attackers stole $6.3 billion from Binance by compromising the system that authorizes wallet transactions, not by breaking encryption or stealing private keys.... og:url: https://daily.dev/posts/crypto-s-biggest-heist-exposes-the-weak-link-in-exchange-security-9wt3wyiyd og:image: https://api.daily.dev/og/posts/9Wt3WYiyD.png og:image:alt: Crypto’s biggest heist exposes the weak link in exchange security og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Crypto’s biggest heist exposes the weak link in exchange security **[TechCentral](https://daily.dev/sources/techcentral)** · 5 min read · 0 upvotes · 0 comments ## Summary Attackers stole $6.3 billion from Binance by compromising the system that authorizes wallet transactions, not by breaking encryption or stealing private keys. A DevOps engineer's compromised laptop reportedly gave access to a service able to submit withdrawals. On Ethereum, the attacker used a delegation feature with 50 pre-signed authorizations to turn a hot wallet into a sweeper. TRM Labs attributes the attack with high confidence to TraderTraitor, a North Korean state-sponsored hacking unit also blamed for the $1.5 billion Bybit theft in February 2025. Binance has frozen about $3 billion and pledged to cover losses from its SAFU reserve. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How did attackers steal $6.3 billion from Binance without stealing private keys? Attackers compromised the system that authorizes wallet transactions rather than the keys themselves, reportedly starting with a DevOps engineer's compromised laptop that gave access to a withdrawal-submission service. On Ethereum, they used a delegation feature with 50 pre-signed authorisations to turn a hot wallet into a sweeper under their control, moving funds across 10 blockchains in about 20 minutes. _Teams building systems that move money or data on instruction can track exchange security incidents like this on daily.dev._ ### Who is believed to be responsible for the Binance hack and the earlier Bybit theft? Blockchain intelligence firm TRM Labs attributes the Binance attack, with high confidence, to TraderTraitor, a North Korean state-sponsored hacking unit also blamed by the FBI for the $1.5 billion Bybit theft in February 2025. Binance itself has not named an attacker, and as of the report no government had confirmed the attribution. _Developers tracking state-sponsored threat actors targeting crypto infrastructure can follow updates like this on daily.dev._ ### What practical steps protect cryptocurrency from exchange hacks like the Binance breach? Use hardware wallets that keep private keys offline and sign transactions on the device, bought new from the manufacturer or authorised reseller. Store the 12- or 24-word seed phrase on paper or metal away from the device, never photographed or typed into a website. For larger holdings, use multisignature wallets requiring multiple keys, so one lost key isn't fatal, since self-custody has no SAFU-style fund to fall back on. _Anyone weighing custody tradeoffs after a major exchange breach can keep up with security guidance on daily.dev._ --- Tags: [#cyber](https://daily.dev/tags/cyber), [#crypto](https://daily.dev/tags/crypto), [#cryptography](https://daily.dev/tags/cryptography) [View this post on daily.dev](https://daily.dev/posts/crypto-s-biggest-heist-exposes-the-weak-link-in-exchange-security-9wt3wyiyd) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Crypto’s biggest heist exposes the weak link in exchange security","url":"https://daily.dev/posts/crypto-s-biggest-heist-exposes-the-weak-link-in-exchange-security-9wt3wyiyd","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/crypto-s-biggest-heist-exposes-the-weak-link-in-exchange-security-9wt3wyiyd"},"datePublished":"2026-10-30T10:49:23.045Z","dateModified":"2026-10-30T11:09:22.761Z","description":"Attackers stole $6.3 billion from Binance by compromising the system that authorizes wallet transactions, not by breaking encryption or stealing private keys....","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/f4c419185cb2fc491391aedc005a3949?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/f4c419185cb2fc491391aedc005a3949?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"TechCentral","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"TechCentral","logo":"https://media.daily.dev/image/upload/s--RsqLDZrL--/f_auto/v1717745297/logos/techcentral","url":"https://daily.dev/sources/techcentral"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/crypto-s-biggest-heist-exposes-the-weak-link-in-exchange-security-9wt3wyiyd","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"cyber,crypto,cryptography","timeRequired":"PT5M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"TechCentral","item":"https://daily.dev/sources/techcentral"},{"@type":"ListItem","position":3,"name":"Crypto’s biggest heist exposes the weak link in exchange security"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/crypto-s-biggest-heist-exposes-the-weak-link-in-exchange-security-9wt3wyiyd#faq","mainEntity":[{"@type":"Question","name":"How did attackers steal $6.3 billion from Binance without stealing private keys?","acceptedAnswer":{"@type":"Answer","text":"Attackers compromised the system that authorizes wallet transactions rather than the keys themselves, reportedly starting with a DevOps engineer's compromised laptop that gave access to a withdrawal-submission service. On Ethereum, they used a delegation feature with 50 pre-signed authorisations to turn a hot wallet into a sweeper under their control, moving funds across 10 blockchains in about 20 minutes. Teams building systems that move money or data on instruction can track exchange security incidents like this on daily.dev."}},{"@type":"Question","name":"Who is believed to be responsible for the Binance hack and the earlier Bybit theft?","acceptedAnswer":{"@type":"Answer","text":"Blockchain intelligence firm TRM Labs attributes the Binance attack, with high confidence, to TraderTraitor, a North Korean state-sponsored hacking unit also blamed by the FBI for the $1.5 billion Bybit theft in February 2025. Binance itself has not named an attacker, and as of the report no government had confirmed the attribution. Developers tracking state-sponsored threat actors targeting crypto infrastructure can follow updates like this on daily.dev."}},{"@type":"Question","name":"What practical steps protect cryptocurrency from exchange hacks like the Binance breach?","acceptedAnswer":{"@type":"Answer","text":"Use hardware wallets that keep private keys offline and sign transactions on the device, bought new from the manufacturer or authorised reseller. Store the 12- or 24-word seed phrase on paper or metal away from the device, never photographed or typed into a website. For larger holdings, use multisignature wallets requiring multiple keys, so one lost key isn't fatal, since self-custody has no SAFU-style fund to fall back on. Anyone weighing custody tradeoffs after a major exchange breach can keep up with security guidance on daily.dev."}}]} ```