- The FBI says North Korea stole more than $6 billion in virtual assets from Binance on or about October 29, 2026.
- Binance traces the breach to a DevOps engineer's laptop, according to BleepingComputer. That points to staff access as a weak point.
- Leaders should check which single laptops can trigger money movement, and whether a second approval stands in the way.
The strongest vault can still have a weak door
Companies spend heavily to protect the systems that hold money. The Binance case suggests the weak point can be a person's laptop instead. The FBI says North Korea stole more than $6 billion in virtual assets from the exchange on or about October 29, 2026. Binance's own account, as reported by BleepingComputer, points to a compromised laptop belonging to a DevOps engineer. The lesson here is that the most valuable machine in a company may be the one an engineer uses every day.
What the FBI has said
The FBI blames North Korea. It calls the activity "TraderTraitor". The U.S. Secret Service and IRS Criminal Investigation worked with the FBI. Together they have watched the thieves swap the stolen assets mainly into Ethereum (ETH). They expect the money to be laundered further through DeFi services and instant swap services. DeFi means financial tools that run on blockchains without a traditional bank.
BleepingComputer adds detail that is not in the FBI notice. It says security researchers also use the names Lazarus Group, Jade Sleet and APT38 for the same hacking group. It gives a higher loss figure of about $6.36 billion, spread over ten blockchains. Most of that money left in just 20 minutes, it says. It also notes that TRM Labs and Chainalysis had already tied the theft to TraderTraitor. The FBI's own figure is the lower, rounder "more than $6 billion".
How the attack worked, as Binance describes it
Binance has linked the breach to a compromised laptop belonging to a DevOps engineer. BleepingComputer relays this account. DevOps engineers run the systems that keep a company's software online. According to that account, the laptop gave the attackers access to a service container, and they used it to submit unauthorized withdrawal transactions. A service container is a packaged program that runs one back-end function.
In plain terms, the attackers got into a trusted system through a trusted person's machine. Then they used that system to move money out. The public account does not say which controls were bypassed. It also does not say how the laptop was compromised. Those gaps matter, and they should not be filled with guesses.
Other thefts BleepingComputer lists point the same way
BleepingComputer lists earlier thefts it links to North Korean hackers. Bitget lost $387.5 million in September 2026. Drift lost $280 million in April 2026. Bybit lost $1.5 billion in February 2025. DMM Bitcoin lost $308 million in May 2024.
In two of these cases, the reported way in was a person's device. In the DMM case, a hacker posed as a recruiter on LinkedIn. A staff member at the wallet company Ginco was tricked into running harmful Python code. The code was disguised as a test for job candidates. In the Bybit case, a Safe{Wallet} developer's computer was compromised.
The Drift case began with six months of patient contact. People posing as a trading firm met Drift contributors in person at industry conferences. BleepingComputer reports a belief that employees' devices were compromised afterwards, either through a poisoned code repository or through a TestFlight app. TestFlight is Apple's tool for testing apps before release.
These are separate incidents. The reports do not show how Binance's laptop was reached. Still, the common thread in several of them is that the people with access are the ones being targeted.
The cleanup has two sides
The FBI, Secret Service and IRS-CI want some firms to block the thieves' addresses. They name node operators, instant exchanges, DeFi services, analytics firms and other virtual asset providers. BleepingComputer counts 628 addresses on the FBI list. Of these, 608 are Ethereum, 19 are Bitcoin and one is Solana. The aim is to close the exits. Stolen funds are only useful to the thieves once they can be cashed out.
Customers got an update too. Binance told BleepingComputer it is preparing to resume the first phase of withdrawals on November 1, in a three-hour window starting at 06:00 UTC. It also said it has covered approximately 95% of the impacted amount.
Questions to put to your team
Not every organisation holds crypto, but many run systems that move money or sign requests. Five questions are worth asking.
First, which individual laptops can reach those systems? Could one compromised laptop be enough? Second, does a payment or withdrawal need a second approval that the first laptop cannot give? Third, how quickly would you notice? BleepingComputer reports that most Binance funds moved in 20 minutes. Fourth, what is the rule when a recruiter sends an engineer a coding test? Fifth, if you run exchange, payment or node services, who owns loading the FBI's address list into your blocking tools?
The Binance account suggests a single compromised laptop can be the first step. Ask whether any one person's device can move money alone.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Federal Bureau of Investigation (FBI).
