Cryptocurrency platform Binance has admitted that it is the victim of a $6.3 billion fraud. Further revelations reveal that a single compromised laptop led to what is being called "the biggest hack in history", making it a global security warning for organizations across all sectors.
"Our initial investigation suggests this security incident may have started with a compromised DevOps engineer's laptop. That gave an attacker access to a service container, where they submitted unauthorized withdrawal transactions," said Binance co-CEO Richard Tang.
The initial laptop breach enabled the threat actor to access a service container and thereby submit unauthorized withdrawals. According to Tang, there is, as yet, no evidence of any wallet private key leak. Binance says that it will share a "detailed technical post-mortem once the investigation is complete".
Funding missile programs
According to investigations company TRM Labs, elements of the attack resembled earlier North Korea-linked hacks. It is widely reported that North Korea uses international cybercrime to fund its missile program.
"An attacker moved approximately $6.36 billion out of Binance wallets on ten blockchains, most of it in about 20 minutes. TRM attributes the attack to TraderTraitor, North Korea's elite hacking unit, based on robust on and off-chain intelligence. We make this judgment with high confidence," TRM Labs said on its website.
Binance is the world's largest cryptocurrency exchange by trading volume, where people can buy, sell and trade digital currencies, such as Bitcoin. Founded in China in 2017, it has hundreds of millions of registered users worldwide. However, the exchange had a chequered history before the hack. In 2023, former chief executive Changpeng Zhao resigned after pleading guilty to money laundering violations. The BBC also reports that last year, a lawsuit accused the company of helping send millions of dollars to terrorist organizations. In 2024, the company claimed to have more than $160 billion in assets.
The Binance attack reinforces a recurring pattern in high-value cyber incidents: initial access is often gained through a single endpoint rather than a sophisticated network intrusion. This echoes warnings from bodies such as the Cybersecurity and Infrastructure Security Agency (CISA) about the risks of inadequate endpoint security in organizations handling sensitive or high-value assets.
