Binance Hack: One DevOps Laptop, $6.3 Billion — and What Red Teaming Does About It
Live updates
- 30 Oct 2026: First publication, based on Binance's initial assessment, on-chain analyses and media reports. Binance has promised a detailed technical post-mortem; we will update this article when it is out.
The short answer · As of 30 October 2026
No cracked key, no zero-day: according to Binance's first assessment, one laptop was enough.
- What happened: On 29 October, billions flowed out of Binance's hot wallets. Binance puts the impact at about $6.3 billion, with about $3 billion frozen. Customers are not supposed to lose anything.
- The thesis: A DevOps engineer's laptop was compromised. Through it, the attacker reached an internal service that is allowed to submit withdrawals. According to Binance, no wallet keys were leaked.
- The pattern is old: LastPass in 2022 and Bybit in 2025 also started at an engineer's computer. The way in is rarely the problem. The problem is how far a single device reaches.
- What red teaming does: It walks exactly this path in a controlled exercise, from the device to the critical action, and shows which control is missing and whether anyone notices.
StarterHow far does an attacker get at your company, from outside and with a stolen account? Red Teaming Starter from €2,500, in 5–7 days.
See the Starter →What we know so far
The incident is less than 24 hours old. So we strictly separate what Binance itself confirms, what analytics firms read from the blockchain, and what is still speculation. In its first statement, Binance writes:
“Binance's initial investigation suggests that the security incident may involve a compromised DevOps engineer's laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions.”
Binance adds that it has found no evidence of leaked wallet private keys.
As of 30 October 2026
What happened overnight
- 29 Oct, 20:21 UTCOn-chain analysis
A transaction with 50 EIP-7702 authorizations targets the hot wallet "Binance 14". Billions start flowing out (analysis by Blockaid).
- around 00:00 UTCConfirmed by Binance
Binance pauses deposits and withdrawals for security checks.
- 30 OctConfirmed by Binance
Binance's initial assessment: a DevOps engineer's laptop was compromised, which gave the attacker access to a service container that submitted withdrawals. No evidence of leaked wallet private keys.
- 30 OctConfirmed by Binance
Binance puts the impact at about $6.3 billion, with about $3 billion frozen. Binance will cover the losses from its SAFU fund and its own funds.
- 30 Octnot confirmed
TRM Labs has "high confidence" that the North Korean group TraderTraitor (Lazarus) is behind it. This is not officially confirmed.
What is still open
- How the laptop was compromised: phishing, a poisoned package, a fake job interview or something else
- What access was stored on the device and why it reached a service that is allowed to submit withdrawals
- Why withdrawals of this size did not need, or got past, a second independent approval
- How the EIP-7702 delegation of the hot wallet was signed if no key was leaked
- The final damage and who is behind it: the Lazarus attribution comes from analytics firms, not from authorities
The thesis: one laptop as a master key
What stands out is not that a laptop was compromised. That happens in every large company, regularly. What stands out is that it was apparently enough. Between a single engineer's device and withdrawals worth billions there was, as far as we know so far, no control that stopped the attacker.
The thesis
Four steps from laptop to withdrawal
- open
The engineer
Binance has not said how the laptop was compromised.
- assumption
Their laptop
It apparently held access that reached all the way into production.
- per Binance
Service container
An internal service that is allowed to submit withdrawals.
- per Binance
Withdrawals
Unauthorized transactions, about $6.3 billion.
One detail fits. According to Blockaid's analysis, the outflow started with a transaction that delegated the hot wallet to foreign code via EIP-7702. Such a delegation has to be signed with the wallet's key. If, as Binance says, no key was leaked at the same time, one explanation is obvious: the attacker did not need the key. They only needed a system that is allowed to use it. The analytics firm TRM Labs reaches a similar conclusion and suspects that the hot wallets' signing infrastructure itself was compromised.
That is a reading, not a finding. Only Binance's technical post-mortem will show whether it holds. The lesson for your company is the same whatever the details: the strongest encryption does not help if an internal service uses it on request.
What sits on a DevOps laptop
DevOps engineers run the infrastructure everything else runs on. To do their job, their device holds access that elsewhere sits behind several doors. An attacker who controls the device does not need to crack a password. They use what is already there.
A typical DevOps laptop
What an attacker takes without cracking a single password
devops@laptop:~$ ls -a
- ~/.kube/configAccess to Kubernetes clusters, often with admin rightsProduction
- ~/.aws/credentialsKeys for cloud accountsProduction
- ~/.ssh/id_ed25519Login to servers and bastion hostsProduction
- Browser sessionsSigned in to cloud console, SSO and Git, often without a new promptProduction
- .env, secrets.yamlDatabase passwords and API keys from projectsProduction
- ~/.docker/config.jsonWrite access to the container registryBuild
- CI tokens, gh authStart pipelines, change code, trigger releasesCode
Not a one-off: a pattern for years
Not a one-off
Three times the same route: through an engineer's computer
2022
LastPass
- 1A DevOps engineer's home computer
- 2Keylogger via vulnerable media software captured the master password
- 3Corporate vault and cloud backups with customer data
Encrypted customer vaults copied
2025
Bybit
- 1A developer's machine at wallet provider Safe{Wallet}
- 2Manipulated code in the wallet interface
- 3Signers approve a malicious transaction
About $1.5 billion, attributed by the FBI to TraderTraitor
2026
Binance
- 1A DevOps engineer's laptop
- 2Service container
- 3Unauthorized withdrawals
About $6.3 billion (Binance estimate)
Groups like Lazarus specialise in exactly this way in. Publicly documented tactics include fake job interviews in which developers are asked to run a “coding task” that loads malware, poisoned packages in public registries and fake updates for developer tools. How fast a single compromised package reaches thousands of developer machines is something we described in the Axios supply chain attack.
Whether the Binance laptop was compromised in one of these ways is open. For defence it matters less than it seems: some device will be compromised at some point. What matters is what happens next.
What it means if you don't run a crypto exchange
You don't keep billions in a hot wallet. But you almost certainly have the same setup: a few people with very far-reaching rights and devices that hold those rights.
Your "service container"
At Binance it was the service that submits withdrawals. For you it is the payment run in the ERP, the customer database export, the deployment pipeline or the admin account of your online shop.
Your DevOps laptop
The computer of the person who runs servers, cloud and pipelines. In a mid-sized company that is often a single admin or an external provider, with more rights than anyone else in the building.
Your night
The attack on Binance started around 20:20 UTC. The question for you is not only whether an alert fires, but whether anyone sees it before the next morning.
How red teaming tests exactly this path
A penetration test asks: which weaknesses does this system have? Red teaming asks: can an attacker reach a specific objective, and does anyone notice? In the Binance scenario the objective is clear: the one action an attacker must never be able to trigger. Our article Red Teaming vs. Penetration Testing explains the difference between the two.
The laptop scenario has its own format: assumed breach. The exercise does not start with the break-in but after it. We assume a developer's laptop is compromised and walk the path step by step. At the end you know not only whether the path is open, but where a control is missing. Whether and how fast your detection fires is what a longer red team engagement with its own detection test measures.
Assumed breach: the laptop scenario
Red teaming walks the path before an attacker does
Starting point: we assume a developer's laptop is compromised.
- 01HarvestWhat can be taken from the device?Kubeconfig with cluster-admin rights, valid for eleven months
- 02MoveDoes it reach production?Yes, via VPN straight to the cluster's API, no second factor
- 03TriggerCan one service trigger the critical action alone?The payment service releases transfers with no amount limit and no second approval
- 04NoticeDoes anyone notice, and when?Alert after 3 hours 40 minutes, response only the next morning
Five questions for your next team meeting
You don't need a provider for this. Ask these questions to whoever runs your servers, cloud and pipelines, and write down where the answer is “I don't know”.
- 1
Which long-lived production credentials sit on developer laptops?
Kubeconfigs, cloud keys and SSH keys without an expiry date are the first loot an attacker looks for. Goal: short-lived access issued on demand, and keys bound to hardware (FIDO2, Secure Enclave) instead of files in the home directory.
- 2
Can a single service or person trigger the most critical action alone?
Payments, data exports, production deployments: are there amount limits, a second approval by another person, or a confirmation channel outside the system? That control is what separates a compromised laptop from a $6 billion loss.
- 3
Is production separated from the work device?
Access to clusters and cloud accounts only through hardened admin paths, with device checks and fresh authentication, not directly from the VPN of the laptop that is also used to read email and install packages.
- 4
Would you notice, and who responds at night?
Unusual cluster access, new tokens, bulk actions outside working hours: are there alerts for these, and is it clear who sees them at night and at weekends and what they may do?
- 5
Do your developers know they are the target?
Fake job interviews with coding tasks, poisoned packages, fake updates: attacks on developers have been documented for years. Test tasks belong in a throwaway environment, not on the device that holds production access.
The Red Teaming Starter: the laptop scenario in 5–7 days
The Red Teaming Starter plays through exactly this path, from the outside and the inside. From outside, we test what an attacker finds and where they get in: leaked credentials, exposed services, logins, APIs. For the internal part we work grey-box: you give us a starting point, such as a standard user account or VPN access. That is where an attacker would stand after compromising a laptop, and it saves days of pure reconnaissance.
We don't ask how many vulnerabilities there are, but how far someone gets who actually wants in. A scanner finds known gaps; it does not find an attack path built from several small weaknesses.
Red Teaming Starter
Four phases, from the outside in
- 01 · Day 1–2Recon
What does an attacker see from outside? OSINT, attack surface, leaked credentials, exposed services, shadow IT.
In the Binance scenarioWho to target, and what is already exposed?
- 02 · Day 3–4Attack and auth
Attacks on logins such as credential spraying, API and authorization bypasses, perimeter weaknesses.
In the Binance scenarioThe way in: account, access, laptop
- 03 · Day 5Access and impact
How deep does the access go? Privilege escalation and lateral movement, proven without touching real data.
In the Binance scenarioFrom the device to the service container
- 04 · Day 6–7Reporting
Attack paths, prioritised findings, concrete remediation and a management summary for leadership.
In the Binance scenarioWhich control is missing, and how to close it
We work production-safe: we don't touch real customer data and we don't cause deliberate outages. Instead of exploiting access, we prove that it would be possible. Before we start there is a written authorisation, a clearly defined scope and an emergency stop with named contacts on both sides.
Two packages
Starter and Starter Plus
Starter
from €2,500about 5 days
How far does an attacker get from outside, and what can they do with a normal account?
- Recon and attacks from the outside
- Attacks on authentication, APIs and authorization
- Light internal part from your grey-box starting point
- Compact proof of how deep the access goes
- Technical report, management summary, online results readout
Starter Plus
from €3,500about 7 days
Does an attacker get from the first foothold to your crown jewels?
- Everything in the Starter
- Deep internal part: privilege escalation and lateral movement
- Attack-path map from the outside in
- One free retest of the critical findings
- Live results readout with your leadership
The Starter is delivered by our security team of four experts in Germany and Vietnam. Our German security lead reviews and signs off every report. If you first want to know what is visible from the outside at all, read our article on attack surface monitoring; if you want individual applications tested thoroughly, a penetration test is the right route. Go to the Starter offer
Frequently asked questions about the Binance hack
What happened in the Binance hack?
On the evening of 29 October 2026, billions flowed out of Binance hot wallets. Binance paused deposits and withdrawals, puts the impact at about $6.3 billion and reports about $3 billion of it as frozen. Binance says it will cover the losses from its SAFU fund and its own funds.
How did the attacker get into Binance?
According to Binance's initial assessment, through a compromised laptop of a DevOps engineer. This gave the attacker access to a service container, from which they submitted unauthorized withdrawals. How the laptop was compromised is not yet known; Binance has promised a technical post-mortem.
Were Binance private keys stolen?
Binance says it found no evidence of leaked wallet private keys. That suggests the attacker did not need a key, but used an internal service that is allowed to submit transactions and have them signed.
What is an assumed breach test?
A red teaming scenario that starts not at the break-in but after it: you assume a device or account is already compromised, such as a developer's laptop, and test how far an attacker gets from there, which controls stop them and whether anyone notices.
How much does the Red Teaming Starter cost?
The Red Teaming Starter costs from €2,500 net (about 5 days, from the outside plus a light internal grey-box part), Starter Plus from €3,500 (about 7 days, with privilege escalation, lateral movement, an attack-path map and one free retest). We quote the fixed price after a short online scoping; it depends on the scope.
Does the Red Teaming Starter test exactly the Binance scenario?
Largely, yes. The internal part of the Starter begins where an attacker would stand after compromising a laptop: with a standard user account or VPN access. How far they get from there to your critical systems is what Starter Plus covers in depth, with privilege escalation and lateral movement. Phishing and social engineering are not included, available as an add-on on request.
Red Teaming Starter
Find the path before an attacker does
In 5–7 days we play through a realistic attack on your company, from the outside and the inside, and show you in black and white how far an attacker gets and how to stop them. Our German security lead reviews and signs off every report.
- Starter, about 5 days
- from €2,500Starter, about 5 days
- Starter Plus, about 7 days
- from €3,500Starter Plus, about 7 days
- phases, from the outside in
- 4phases, from the outside in
- real customer data touched
- 0real customer data touched
- ✓Grey-box: you give us a starting point, such as a standard user account or VPN access
- ✓Production-safe: no real customer data, no deliberate outages, agreed emergency stop
- ✓We report critical findings immediately, not only in the report
- ✓Technical report, management summary and results readout
- ✓Methodology per PTES, NIST SP 800-115 and MITRE ATT&CK
- ✓Written authorisation and rules of engagement before the start
We quote the fixed price after a short online scoping. Phishing and social engineering are not included, available as an add-on on request.
Sources
- Binance on X: initial assessment of the security incident (30 Oct 2026)
- CoinDesk: Binance loses over $6 billion in the largest crypto hack to date
- CoinDesk: North Korea’s Lazarus Group likely behind Binance hack, blockchain sleuths say
- crypto.news: Binance hack — how one wallet trick led to a $6.3 billion breach (Blockaid analysis)
- Euronews: Binance confirms major hack with more than $2.5bn frozen
- FBI: North Korea responsible for $1.5 billion Bybit hack (PSA, 26 Feb 2025)
- Wikipedia: 2022 LastPass data breach
