Skip to content
OriginalSign in

Dark ReadingJai Vijayan

Binance Hack Shows How One Laptop Led to Billions in Losses

Part of the TraderTraitor story · since 9 Mar

Developinglatest 50 minutes ago25 articles11 outlets
9 Mar · The Hacker News first8 Jul18 Aug28 SepNowThis article25th of 25
  • Mon 9 Mar, 16:26 UTC. The Hacker News, first report. North Korea's UNC4899 uses AI IDE backdoor to seize crypto funds.
  • Tue 21 Apr, 10:21 UTC. SecurityWeek, its first report on the story. North Korea linked hackers steal $290M from Kelp DAO DeFi.
  • Tue 21 Apr, 19:27 UTC. Security Affairs, its first report on the story. Lazarus Group siphons $290M from Kelp DAO via LayerZero exploit.
  • Thu 23 Apr, 15:01 UTC. The Hacker News. North Korean hackers steal $290m via LayerZero KelpDAO breach.
  • Fri 1 May, 21:31 UTC. Dark Reading, its first report on the story. North Korea Holds 76% of Stolen Crypto in 2026 After Big Hacks.
  • Mon 7 Sep, 11:26 UTC. Infosecurity, its first report on the story. Researchers Map Lazarus Into Six North Korean Cyber Units.
  • Mon 21 Sep, 06:21 UTC. The Hacker News. Jade Sleet Breach Exposes Backdoors and Rising AI Threats.
  • Mon 28 Sep, 02:30 UTC. SecurityOnline, its first report on the story. North Korean Hackers Hide macOS Backdoors in Fake Coding Tests.
  • Mon 12 Oct, 09:11 UTC. SecurityOnline. Fake Terraform AWS provider installs backdoors on developer systems.
  • Thu 29 Oct, 18:30 UTC. Microsoft, its first report on the story. Microsoft reports North Korean groups expanding AI operations.
  • Fri 30 Oct, 08:30 UTC. SecurityWeek. North Korea’s TraderTraitor linked to $6.36 billion Binance heist.
  • Fri 30 Oct, 09:00 UTC. SecurityOnline. Binance probe traces $6.36 billion hack to DevOps breach.
  • Fri 30 Oct, 09:30 UTC. SOCRadar, its first report on the story. Binance reports $6.3 billion theft from its hot wallets.
  • Fri 30 Oct, 12:00 UTC. Infosecurity. Analysts attribute Binance’s $6.3bn hack to North Korean group.
  • Fri 30 Oct, 13:00 UTC. Malwarebytes, its first report on the story. Binance reports $6.3 billion theft linked to North Korean group.
  • Fri 30 Oct, 14:30 UTC. Ars Technica, its first report on the story. TRM Labs links record $6.3 billion Binance heist to North Korea.
  • Fri 30 Oct, 19:30 UTC. Security Affairs. TRM Labs attributes $6.3 billion Binance theft to North Korea.
  • Sun 1 Nov, 08:30 UTC. The Hacker News. FBI blames North Korea group for $6.43 billion Binance heist.
  • Sun 1 Nov, 09:55 UTC. cybersixt, its first report on the story. How North Korea is laundering $6.4 billion stolen from Binance.
  • Sun 1 Nov, 20:30 UTC. Security Affairs. FBI blames North Korea linked group for Binance theft.
  • Mon 2 Nov, 09:00 UTC. SecurityOnline. North Korean groups use AI to accelerate cyber operations.
  • Mon 2 Nov, 09:30 UTC. SecurityWeek. FBI Links North Korea’s TraderTraitor to Binance Heist.
  • Mon 2 Nov, 11:00 UTC. Infosecurity. FBI links Binance crypto breach to North Korea’s TraderTraitor.
  • Mon 2 Nov, 19:30 UTC. The Hacker News. FBI blames North Korean TraderTraitor for $6.43 billion heist.
  • Mon 2 Nov, 23:30 UTC. Dark Reading. Binance Hack Shows How One Laptop Led to Billions in Losses. This article, 25th of 25.

The Dark Reading piece reports that Binance’s record hack began with a compromised developer laptop, which allowed attackers to reach an internal service container with the authority to initiate withdrawal requests. From there, the attackers exploited additional breach points and an Ethereum account-delegation mechanism to gain transaction approval for a hot wallet, draining billions of dollars in around 20 minutes.

The FBI links the operation to North Korea’s TraderTraitor group, and Binance has said there is no evidence that leaked wallet keys were used. The article frames this as a warning about how weak system separation and untested attack paths can turn a single compromised device into a much broader loss.

Analysts quoted in the piece argue Binance—and by extension other exchanges—needed stronger, independent safeguards to prevent a compromised system from approving transfers. Points raised include segregating funds across hot and cold wallets, ensuring privileged operations occur on dedicated workstations, 24/7 monitoring for anomalous activity, and enforcing multi-layered controls around private-key use and transfer approvals.

The article emphasises testing entire attack paths—“laptop to payout”—rather than relying on individual controls, noting that attackers can make valid-looking transfers via the platform’s signing system even when the underlying action is inappropriate. It also highlights the broader implication for organisations: the blast radius after initial access must be limited, with layered, independent controls and threat modelling applied to prevent catastrophic outcomes. Binance has reportedly frozen about $3 billion and claimed to have replenished roughly 95% of affected assets.

How the story developed

All 25 articles
Developinglatest 50 minutes ago25 articles11 outlets

25 articles from 11 outlets since 9 Mar. Still developing; the latest report was 50 minutes ago. This was the 25th report, 238 days after the first.

Now9 Mar2529162535 Sep172641119First reportThe Hacker News · 9 Mar, 16:26This article25th of 25 · day 238Picked up againafter 6 weeks quiet
  • Mon 9 Mar, 16:26 UTC. The Hacker News, first report. North Korea's UNC4899 uses AI IDE backdoor to seize crypto funds.
  • Tue 21 Apr, 10:21 UTC. SecurityWeek, its first report on the story. North Korea linked hackers steal $290M from Kelp DAO DeFi.
  • Tue 21 Apr, 19:27 UTC. Security Affairs, its first report on the story. Lazarus Group siphons $290M from Kelp DAO via LayerZero exploit.
  • Thu 23 Apr, 15:01 UTC. The Hacker News. North Korean hackers steal $290m via LayerZero KelpDAO breach.
  • Fri 1 May, 21:31 UTC. Dark Reading, its first report on the story. North Korea Holds 76% of Stolen Crypto in 2026 After Big Hacks.
  • Mon 7 Sep, 11:26 UTC. Infosecurity, its first report on the story. Researchers Map Lazarus Into Six North Korean Cyber Units.
  • Mon 21 Sep, 06:21 UTC. The Hacker News. Jade Sleet Breach Exposes Backdoors and Rising AI Threats.
  • Mon 28 Sep, 02:30 UTC. SecurityOnline, its first report on the story. North Korean Hackers Hide macOS Backdoors in Fake Coding Tests.
  • Mon 12 Oct, 09:11 UTC. SecurityOnline. Fake Terraform AWS provider installs backdoors on developer systems.
  • Thu 29 Oct, 18:30 UTC. Microsoft, its first report on the story. Microsoft reports North Korean groups expanding AI operations.
  • Fri 30 Oct, 08:30 UTC. SecurityWeek. North Korea’s TraderTraitor linked to $6.36 billion Binance heist.
  • Fri 30 Oct, 09:00 UTC. SecurityOnline. Binance probe traces $6.36 billion hack to DevOps breach.
  • Fri 30 Oct, 09:30 UTC. SOCRadar, its first report on the story. Binance reports $6.3 billion theft from its hot wallets.
  • Fri 30 Oct, 12:00 UTC. Infosecurity. Analysts attribute Binance’s $6.3bn hack to North Korean group.
  • Fri 30 Oct, 13:00 UTC. Malwarebytes, its first report on the story. Binance reports $6.3 billion theft linked to North Korean group.
  • Fri 30 Oct, 14:30 UTC. Ars Technica, its first report on the story. TRM Labs links record $6.3 billion Binance heist to North Korea.
  • Fri 30 Oct, 19:30 UTC. Security Affairs. TRM Labs attributes $6.3 billion Binance theft to North Korea.
  • Sun 1 Nov, 08:30 UTC. The Hacker News. FBI blames North Korea group for $6.43 billion Binance heist.
  • Sun 1 Nov, 09:55 UTC. cybersixt, its first report on the story. How North Korea is laundering $6.4 billion stolen from Binance.
  • Sun 1 Nov, 20:30 UTC. Security Affairs. FBI blames North Korea linked group for Binance theft.
  • Mon 2 Nov, 09:00 UTC. SecurityOnline. North Korean groups use AI to accelerate cyber operations.
  • Mon 2 Nov, 09:30 UTC. SecurityWeek. FBI Links North Korea’s TraderTraitor to Binance Heist.
  • Mon 2 Nov, 11:00 UTC. Infosecurity. FBI links Binance crypto breach to North Korea’s TraderTraitor.
  • Mon 2 Nov, 19:30 UTC. The Hacker News. FBI blames North Korean TraderTraitor for $6.43 billion heist.
  • Mon 2 Nov, 23:30 UTC. Dark Reading. Binance Hack Shows How One Laptop Led to Billions in Losses. This article, 25th of 25.
  • CVE not in KEV
  • No CVE
  • Larger: an outlet’s first report
  • Coverage over time
  • Quiet time, folded
Show all 25 articles as a list
  1. Mon 9 MarDay 01
    1. North Korea's UNC4899 uses AI IDE backdoor to seize crypto funds16:26 · The Hacker News · First report

  2. Quiet for 6 weeks

    Tue 21 AprDay 432
    1. North Korea linked hackers steal $290M from Kelp DAO DeFi10:21 · SecurityWeek · Picked up again
    2. Lazarus Group siphons $290M from Kelp DAO via LayerZero exploit19:27 · Security Affairs

  3. Quiet for 2 days

    Thu 23 AprDay 451
    1. North Korean hackers steal $290m via LayerZero KelpDAO breach15:01 · The Hacker News

  4. Quiet for 8 days

    Fri 1 MayDay 531
    1. North Korea Holds 76% of Stolen Crypto in 2026 After Big Hacks21:31 · Dark Reading · Picked up again

  5. Quiet for 18 weeks

    Mon 7 SepDay 1821
    1. Researchers Map Lazarus Into Six North Korean Cyber Units11:26 · Infosecurity · Picked up again

  6. Quiet for 2 weeks

    Mon 21 SepDay 1961
    1. Jade Sleet Breach Exposes Backdoors and Rising AI Threats06:21 · The Hacker News · Picked up again

  7. Quiet for 7 days

    Mon 28 SepDay 2031
    1. North Korean Hackers Hide macOS Backdoors in Fake Coding Tests02:30 · SecurityOnline · Picked up again

  8. Quiet for 2 weeks

    Mon 12 OctDay 2171
    1. Fake Terraform AWS provider installs backdoors on developer systems09:11 · SecurityOnline · Picked up again

  9. Quiet for 2 weeks

    Thu 29 OctDay 2341
    1. Microsoft reports North Korean groups expanding AI operations18:30 · Microsoft · Picked up again
  10. Fri 30 OctDay 2357
    1. North Korea’s TraderTraitor linked to $6.36 billion Binance heist08:30 · SecurityWeek
    2. Binance probe traces $6.36 billion hack to DevOps breach09:00 · SecurityOnline
    3. Binance reports $6.3 billion theft from its hot wallets09:30 · SOCRadar
    Show 4 more from 30 Oct
    1. Analysts attribute Binance’s $6.3bn hack to North Korean group12:00 · Infosecurity
    2. Binance reports $6.3 billion theft linked to North Korean group13:00 · Malwarebytes
    3. TRM Labs links record $6.3 billion Binance heist to North Korea14:30 · Ars Technica
    4. TRM Labs attributes $6.3 billion Binance theft to North Korea19:30 · Security Affairs

  11. Quiet for 2 days

    Sun 1 NovDay 2373
    1. FBI blames North Korea group for $6.43 billion Binance heist08:30 · The Hacker News
    2. How North Korea is laundering $6.4 billion stolen from Binance09:55 · cybersixt
    3. FBI blames North Korea linked group for Binance theft20:30 · Security Affairs
  12. Mon 2 NovDay 2385
    1. North Korean groups use AI to accelerate cyber operations09:00 · SecurityOnline
    2. FBI Links North Korea’s TraderTraitor to Binance Heist09:30 · SecurityWeek
    3. Binance Hack Shows How One Laptop Led to Billions in Losses23:30 · Dark Reading · This article, 25th of 25
    Show 2 more from 2 Nov
    1. FBI links Binance crypto breach to North Korea’s TraderTraitor11:00 · Infosecurity
    2. FBI blames North Korean TraderTraitor for $6.43 billion heist19:30 · The Hacker News

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in