Binance Says 'No Wallet Private Key Leak.' It Didn't Need One: A DevOps Engineer's Laptop Moved $6.3 Billion

Binance’s first explanation for what is now the largest theft in crypto history came with a reassurance:

“We have found no evidence of any wallet private key leak.”

Read the sentence before it, though:

“Binance’s initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions.”

So the keys stayed put. The attacker didn’t need them, because they got into the system that asks for signatures. Binance’s own estimate of the damage is about $6.3 billion. That is roughly four times Bybit’s ~$1.5B loss in February 2025, which held the record until Thursday.

This is a live story. Figures below are as of about 01:00 UTC on October 30 and are still moving.

---

What Happened

Victim	Binance (Binance.US is not affected, per Cointelegraph)
When	October 29, 2026. Arkham puts the start around 20:30 UTC (4:30 p.m. ET)
Total impact	~$6.3B by Binance’s estimate. Chainalysis: $5.912B at the time of theft. Arkham: ~$5.84B sitting in wallets it labels “binance-hacker-1029”
Assets	Mostly ETH and stablecoins. On-chain trackers saw 167,464 ETH plus 63 other tokens leave in one move, and 780M USDC leave a second address
Attack vector (preliminary)	Compromised DevOps engineer’s laptop → service container → unauthorized withdrawal transactions
Frozen	$3B verified by Binance as of 00:52 UTC Oct 30
Attribution	Binance hasn’t named anyone. TRM Labs: North Korea’s TraderTraitor, “high confidence”
Status	Deposits and withdrawals suspended. No resume date. No post-mortem yet
Who pays	Binance says it will cover all losses

---

The Laptop, the Container, and the Keys Nobody Stole

Binance’s account is preliminary, and it isn’t the only one.

• Binance: a DevOps laptop was compromised, which gave access to a service container, which submitted withdrawals. No private key leak found.
• Blockaid CEO Ido Ben-Natan called it “a compromise of signing infrastructure. We don’t think a key was leaked.”
• Arkham CEO Miguel Morel said the attacker may have exploited EIP-7702 delegation, or gained access to “private keys or systems used to approve transactions.”
• On-chain, CryptoTicker’s tracking shows the “Binance 14” wallet being delegated via EIP-7702 to an outside contract at about 20:20 UTC. The attacker’s address was seeded with 0.1 ETH from Tornado Cash.

These accounts fit together better than they first appear. If you control the machine that builds and submits withdrawals, you can get valid signatures without ever copying a key out. We wrote about the same pattern three days ago when Bloom said “no private keys were compromised” and the chain showed every drain signed with the wallet’s own key. Bloom lost under $1M. This time it’s an exchange, and the bill is $6.3B.

For users, “no key leak” is mostly a technical detail. If the attacker could get the wallet to sign, the wallet wasn’t safe.

---

Why $3 Billion Came Back So Fast

The attacker took a lot of stablecoins, and stablecoin issuers can freeze them. The issuers moved within about an hour of the start:

• Circle (Jeremy Allaire, ~21:18 UTC): “we have frozen more than 800M USDC associated with the incident.”
• Tether (Paolo Ardoino, ~21:25 UTC): “Tether froze more than 1.567B USDT related to a potential Binance exchange hack.” (CZ’s own tally put Tether’s freeze at ~$971M. The two figures haven’t been reconciled.)
• Ripple froze about $200M, per Binance co-founder Yi He, presumably RLUSD.
• World Liberty Financial froze $27M of USD1 and $2M of WLFI.
• Arbitrum’s Security Council moved 74.56M ARB into a frozen intermediary wallet.
• First Digital froze FDUSD, amount not disclosed. Aave froze markets across V3 and V4 and said positions remain overcollateralized.

Binance’s verified frozen total went from $2.54B at 23:35 UTC to $3B at 00:52 UTC.

The Aave move

The attacker seems to have known which assets could be frozen. Before the freezes landed, they posted stolen USDT as collateral on Aave and borrowed about 20,000 WETH, roughly $44 million (LlamaRisk counts 19,762 WETH, ~$44.6M). Once Tether froze the USDT, the collateral was stuck, but the ETH borrowed against it was already in the attacker’s hands, and ETH has no issuer to freeze it.

That still leaves around half of Binance’s $6.3B estimate, mostly ETH and other non-freezable assets, outside anyone’s reach.

---

Who Did It

Binance hasn’t attributed the attack and says it’s working with law enforcement. The investigators have:

• TRM Labs traced it to TraderTraitor, “an elite North Korean hacking group,” with “high confidence.”
• ZachXBT named the Lazarus Group as the “likely attacker.”
• Blockaid: “the tactics and level of sophistication we’ve seen so far are consistent with the kinds of operations we’ve seen from DPRK.”

If that holds, it’s the same playbook as Bybit: don’t attack the smart contract, compromise a person and the infrastructure that person can reach. Bybit’s attackers got in through a Safe developer’s machine. This time it was, by Binance’s account, a DevOps engineer’s laptop.

---

What Binance and CZ Said

• CZ (~21:15 UTC): “User funds are safe! It does look like a hack on Binance.” Also: “I don’t manage Binance (.com) anymore,” and “as a shareholder, I expect all user funds will be fully covered.”
• Yi He: “Binance will cover all hacking losses.” And: “Deposits and withdrawals are temporarily suspended while our team conducts security checks, freezes funds, and works with law enforcement.”
• Binance: it will share “a detailed technical post-mortem” once the investigation is done. Per CryptoTicker, losses will be covered from SAFU and company funds, with an updated proof of reserves to follow. CoinDesk notes SAFU itself holds roughly $1B in bitcoin, so most of a $3B-plus uncovered gap would have to come from Binance’s own balance sheet.

Bybit, for the record, posted that it is “not affected.”

---

The Market

• BTC fell to just under $77,000, its weakest level in more than a month (CoinDesk). It was around $77,860 by 03:44 UTC.
• BNB −8%, ETH −5.7%, AAVE −11%, UNI −10.7%.
• The Fear & Greed Index hit 30, its first “fear” reading since August.
• CoinGlass data cited by PANews shows about $628M in positions liquidated within one hour, ~$607M of it longs.
• Wintermute said its Binance exposure was “less than 20% of net equity.” GSR said “less than 5%.”

And it was the second breach of the day. Earlier on Thursday, Polymarket halted trading after a compromise at a third-party provider, with user losses under $3M. It says it has fixed the issue and will reimburse users.

---

Why This Matters for Crypto Jobs

One laptop. By Binance’s own preliminary account, the largest theft in crypto history started on one engineer’s machine, not in a smart contract. That changes what exchanges will spend on:

• Endpoint and DevOps security. Hardened workstations, device attestation, zero-trust access to production containers, and separation between “can deploy” and “can move funds.” Expect security engineers who know Kubernetes, CI/CD and IAM to be in demand at every major exchange and custodian by Q1.
• Signing infrastructure and wallet ops. If keys stay safe but the system that requests signatures is owned, the job is policy engines, transaction simulation, withdrawal anomaly detection and human-in-the-loop approvals for large outflows. The EIP-7702 delegation angle adds smart-account security to that list.
• Incident response and threat intel. DPRK has now taken the top two spots on the all-time hack list by getting at people, not code. Red teams that run realistic social-engineering and supply-chain scenarios against engineers are going to get more budget.
• Freeze ops and compliance. Circle, Tether, Ripple, World Liberty, First Digital, Arbitrum’s Security Council and Aave all acted within hours, and that recovered about half the loss. Issuers and protocols that can’t freeze that quickly will be hiring for it.
• On-chain forensics. TRM, Chainalysis, Arkham, Blockaid and independent investigators produced the attribution and tracing while Binance was still investigating. That work will keep growing.

If you can secure the boring machinery (laptops, containers, deploy pipelines), you’re now one of the most valuable people an exchange can hire.

---

Looking for a role in crypto security, infra or compliance? Browse thousands of open Web3 jobs at Cryptogrind, updated daily.