- Binance estimates its breach at about $6.3 billion and says it may have started with a compromised DevOps engineer's laptop.
- Binance's later update found more breach points. It has not said how the laptop was compromised.
- Aikido advises approvals for high-value actions outside the requesting service, and short-lived credentials on developer machines.
A laptop is a small thing to lose a fortune over. Binance says the breach may have started with exactly that: a DevOps engineer's laptop. The exchange estimates the damage at roughly $6.3 billion.
The deeper issue is not the laptop. It is how much trust one engineer's machine can carry, and whether anything stands between that trust and the money.
What Binance has said so far
Binance says the laptop gave the attacker a way into a service container. From there, the attacker sent withdrawals that nobody had approved. The exchange says it has frozen about $3 billion on the blockchain and will cover all losses.
Co-CEO Richard Teng posted on X that the attacker did more than borrow one engineer's access. He said the attack involved more than a single click. So far Binance sees no sign that a wallet's private key leaked.
A later update said further work had found more breach points beyond the laptop. It gave no details. A technical post-mortem will follow once the facts are checked.
Teng later said the attacker used EIP-7702, an existing Ethereum feature. It let the attacker get on-chain approval to act on a hot wallet, which is a wallet kept online for fast payments. Teng said that approval skipped Binance's usual checks.
Analysts at TRM Labs and Chainalysis link the incident to TraderTraitor, a hacking unit tied to North Korea. Binance has not confirmed the link.
Why a laptop is worth attacking
The security firm Aikido wrote the analysis behind this story. It says Binance's public statements do not explain how the attacker got onto the laptop. What it describes about the route is how such attacks usually go, not what happened at Binance.
Aikido lists what usually sits on a developer's machine: cloud logins, SSH keys, git logins and Kubernetes settings. Many are stored as plain files that any program run by that user can open.
Live session tokens matter too. A token proves a login already happened. Aikido says a token can keep working after a password reset and can bypass multi-factor authentication.
With that material, Aikido says, an attacker can act as the engineer. The activity appears in the logs under the engineer's name. It looks like normal work, so it is hard to tell from the engineer's own.
How a laptop could lead to a withdrawal
Aikido sketches one plausible chain. Malicious code on the laptop collects credentials and tokens. The attacker uses them to reach an internal system, such as a build server or cloud account. From there they move to systems with broader reach, gathering more credentials at each step. The last hop lands on a service trusted to send withdrawals.
One puzzle is how the attacker moved money without stealing any keys. Aikido offers an answer built on EIP-7702, which lets a normal wallet pass its powers to a separate program. The wallet's own key must sign off on that handover. Aikido infers that Binance's internal signing system produced that approval, so the keys never left their place. That is Aikido's inference, not a Binance finding. Blockaid's CEO reached a similar preliminary view of compromised signing infrastructure.
Aikido also points to the 2025 Bybit theft as a similar shape. Safe's preliminary findings, as reported by heise, put the start at February 4, when a developer's laptop was compromised. Attackers then used a stolen AWS session token inside the company's cloud. On February 17 they injected malicious code, and the theft followed on February 21. That is one comparable case, not proof of a pattern.
The idea behind the incident
Here is the design risk this incident may expose. A company's real perimeter is not its firewall. It is the set of people and machines whose approvals the system believes.
Take a service that can both request a withdrawal and approve it. Whoever controls that service then controls the money. Binance has not said its systems worked this way. The idea rests on Aikido's inference about the signature, and the post-mortem may change the picture.
Aikido also gives a sense of how common the threat is. Its tools blocked nearly 500 malware attacks aimed at developer devices in the past week, roughly 70 daily. That is one vendor's account of its own customers' week.
What leaders should ask their teams
Aikido recommends four controls. Each is a question a leadership team can put to its engineers.
First: do long-lived credentials sit on developer disks? Aikido advises short-lived ones that expire in hours.
Second: can a service approve its own high-value actions? Aikido's advice is to move the sign-off to a separate system, and to cover changes to a wallet's permissions as well as payments.
Third: would anyone notice a credential or session used from a place or time the engineer never works from?
Fourth: do contractor and personal machines that reach production fall under company management, with the same controls as every other laptop?
Binance's full post-mortem is still to come. The questions above do not depend on it. Any system that treats one person's laptop as proof of identity makes that laptop part of the vault.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Aikido Security.
