Binance Security Incident: Hacker Access via DevOps Laptop

Representatives of the Binance cryptocurrency exchange reported on a security incident that led to unauthorized withdrawals from the platform. According to the company, the attacker managed to access the infrastructure through a compromised DevOps engineer's laptop.

This allowed the malicious actor to penetrate one of the exchange's service containers and send unauthorized fund withdrawal requests affecting hot wallets.

• The incident affected Binance hot wallets on the Ethereum network, resulting in a large outflow of funds within a short period.
• The attacker did not steal private keys directly but replaced the wallet code using EIP-7702.
• Tether and Circle promptly froze a significant portion of the stolen stablecoins.
• TRM Labs linked the attack to the North Korean APT group TraderTraitor.

Attack Details and Exploitation Method

The security breach occurred on October 29, when between $2.5 billion and $3.5 billion left Binance hot wallets on the Ethereum network within forty minutes. Instead of directly stealing coin keys, the attacker replaced the code of Binance wallet 14 via EIP-7702 and drained its contents in a single call. Meanwhile, Binance has not publicly disclosed the exact technical vectors of how the laptop was compromised or why standard transaction control mechanisms failed.

Analytics firm TRM Labs associated the attack with the North Korean cyberespionage group TraderTraitor. Experts previously linked the same group to the massive $1.5 billion Bybit exchange hack in February 2025. The recipient address involved in the current transaction is also believed to be connected to Tornado Cash, a cryptocurrency mixer designed to obfuscate transaction histories.

Stablecoin Issuer Response and Binance Measures

Infrastructure partners and stablecoin issuers took immediate action following the detection of suspicious activity. Within the first hour of the attack, Tether and Circle froze approximately $971 million in USDT and $823 million in USDC. Tether later increased its frozen holdings to roughly $1.67 billion, substantially hindering the attacker's ability to launder funds through privacy mixers.

Binance management committed to fully covering user losses using its SAFU user protection fund and corporate assets. The company also announced that it will provide proof of reserves and publish a detailed technical post-mortem analysis of the incident once all consequences are fully contained and resolved.

Implications for the Crypto Industry

This security breach stands as one of the most significant stress tests for centralized cryptocurrency exchange architectures in recent times. The scale of the attack highlights the critical vulnerability of human elements and developer workstations, which can serve as entry points into sophisticated systems despite robust blockchain-layer security protocols.

For the broader tech and business community, the incident underscores the ongoing challenges of securing internal corporate infrastructure against targeted advanced persistent threats. The swift asset freezing by major stablecoin issuers demonstrates the presence of control mechanisms in digital assets, yet it reinforces the absolute necessity for continuous security audits and strict access controls across all operational levels.