Binance Attributes $6.3B Breach to Compromised DevOps Laptop as Freezes Reach $3B

Binance has put the estimated total impact of the security breach disclosed on Oct. 29 at $6.3 billion, with roughly $3 billion in stolen assets already verified as frozen, according to figures released by the exchange. The company said it will "cover all losses" and expects withdrawals to resume within 48 hours once a security revamp of its withdrawal service is complete. Deposits are operating normally.

The exchange's initial investigation points to a compromised laptop belonging to a DevOps engineer, which may have allowed an attacker to access a service container and submit unauthorized withdrawal transactions. Binance said it has found no evidence of a wallet private-key leak, though the investigation remains ongoing.

Who is behind the attack?

Attribution is converging quickly. Chainalysis co-founder and CEO Jonathan Levin said the hack was likely carried out by North Korea's TraderTraitor group, citing links to a previous incident, and put the theft at $6.4 billion — slightly above Binance's estimate. TRM Labs attributed the attack to TraderTraitor with "high confidence," based on what it called "robust on and off-chain intelligence." The FBI has previously named TraderTraitor as the group behind the ByBit hack in February last year.

Onchain investigator ZachXBT said stolen funds from the Binance attack and the earlier Bitget exploit were commingled in the same address after arriving via THORChain. "This indicates the same actor is likely behind both incidents," he wrote. Blockaid co-founder and CEO Ido Ben-Natan also noted sophisticated onchain preparation, a customer sweeper contract and multiple authorizations consistent with North Korean operations.

How were the funds frozen?

The freeze effort spans the largest stablecoin issuers and multiple protocols:

• Tether froze more than $1.567 billion in USDT; Circle froze more than $800 million in USDC, according to their CEOs.
• First Digital CEO Vincent Chok confirmed the firm froze stolen FDUSD and said: "Our priority is protecting FDUSD holders and stopping bad actors from moving stolen funds."
• World Liberty Financial froze $27 million in USD1 and $2 million in WLFI, working with BitGo.
• Ripple is freezing affected RLUSD holdings, per stablecoins SVP Jack McDonald.
• The Arbitrum Security Council froze $30.5 million — 74.6 million ARB and 8,425 ETH — moving the funds to an intermediary frozen wallet.

Frozen assets also include USDT, USDC, RLUSD, USD1, XUSD, USDT0, WBETH, XAUT, PAXG, USDP and ARB. Chainalysis placed the total stolen at $5.912 billion at the time of theft — four times the ByBit theft of 2025.

What does this change for DeFi operators?

Aave froze markets across its V3 and V4 deployments after the exploiter deposited 60 million USDT and borrowed 19,762 WETH, worth about $44.6 million, in a three-minute window on Oct. 29. The freeze covered 175 reserves on V3 across 16 networks and 117 reserves on V4 across four networks. Risk provider LlamaRisk said the position, backed by $59.9 million in collateral against $43.8 million in debt, remains subject to normal liquidation and does not put suppliers at risk — but a prolonged freeze could push borrowing rates higher as liquidity drains.

Market makers Wintermute and GSR disclosed exposure to Binance below 20% and 5% of net equity respectively, with neither expecting operational disruption. Standard Chartered's Geoffrey Kendrick argued the breach could accelerate the shift toward decentralized exchanges, noting the top-10 spot DEX-to-CEX ratio reached 23.5% in Q2 2026, up 2.1 percentage points quarter over quarter.

What does this change for practitioners? Freezable stablecoins and issuer coordination have become the primary containment mechanism for exchange breaches, and the next 48 hours will test whether Binance can restore withdrawals without further fund movement by the attacker.