Binance Hack Details: $6.3 BILLION Stolen
The Largest Crypto Theft In History. But How Did It Happen?
The hack has been attributed to state-sponsored actors by the name of TraderTraitor from North Korea.
The same group was responsible for the 2025 Bybit theft/hack of $1.5 billion; meaning they've broken their own record.
According to Binance's official updates the attackers didn't actually steal the cryptographic passwords/private keys, but instead gained entry to a Binance DevOps engeer's laptop. Likely this was done with a malicious script or malware of some kind.
This laptop held automated credentials for secure tunnels(SSH presumably?) connecting to internal Binance infrastrcuture.
Specifically, they gained access to an internal service container.
In modern cloud-deployments containers such as Docker or Kubernetes are the industry-standard way of shipping & developing sofware.
The complex infrastructure of modern websites & their numerous systems are broken up into micro-services via containers.
A container is similar to a virtual machine in many respects, but it's even further separated from physical hardware as it's not relying on a hypervisor.
Inside the container is everything necessary to the app/service to run, and nothing more. This makes them smaller,lightweight, and portable.
Once inside that container, the hacker simply tricked the automated system into signing off on and pushing through $6.3 billion in unauthorized withdrawal transactions directly to their own addresses.
Essentially, the hacker didn't break into the vault itself; they took over the digital workstation that tells the vault where to send the money.
What's even worse, this is very similar to how they pulled off the Bybit hack in 2025.
So, the hacker didn't break into the vault itself; they took over the digital workstation that tells the vault where to send the money.
Breaking the crypto is hard, but people are the weak link. You would think there would be checks in place for big transfers. I don't have anything on such exchanges so I have to do my own security.
Well, my guess is that the container they were operating in was the service that has final approval on something like that. After all, they transferred other people's money.
I'm sure there were people that don't even know the exchange has that capability to begin with.
On the positive side, Binance has already said they'll make everyone whole.
Also, $1.5 billion of it was stable-coins like Tether, and supposedly they can actually pull those back or undo the transfer. They froze them, and they act differently because they're centralized. Makes me wonder why they bothered to transfer them in the first place.
Without a doubt, a tough blow for many 🤕
Binance claims they are going to make everyone whole.
They supposedly have $100 billion at their disposal.
so many people dreams and investment vanishes swiftly.
via HiveSuite
Well Binance claims they will cover all the losses, and they appear to have the funds to so. So there's a positive there.
u never know what going to happen. hope for the best
via HiveSuite
All crypto transactions are traceable so this hacker may have troubles when they try to cash out.
Thanks for the explanation as always humans are the problem. Imagine what AI will do!😂👍
Yes, but that's probably also why North Korea is the home of this collective.
Also, I would think it's possible to move the funds onto a private wallet and maybe somehow bring them back onto the chain somehow?
A lot of ransoms and illegal activity have been conducted with crypto so there have to be ways. Same group pulled off $1.5 billion last year.
There are very simple ways to track crypto even if it is on a cold wallet. The tx numbers are marked as stolen and as soon as they turn up on an exchange for sale are flagged.
Getting in through a DevOps engineer's laptop instead of cracking keys is a scary reminder, and TraderTraitor topping their own Bybit record makes it the biggest theft yet.
Yeah, and with the Bitby job there's more detailed information where they got into the laptop via a supply-chain-attack which is kind of like a long-con or long-game.
I covered this a while back about the Arch Linux AUR repository attack earlier this year. I think that was mostly considered a failure, and maybe even a troll of some kind.
But the idea is that you slip malicious code into developer supply-chain repositories that downstream projects rely on, and you hope your malicious code makes it onto a system with credentials that are useful in a serious exploit; like this one.