Binance attributes $6.3 billion crypto heist to compromised DevOps workstation

Binance, the world’s largest digital asset exchange, announced that a theft involving roughly $6.3 billion in cryptocurrency can be traced back to a compromised laptop used by a DevOps engineer within the firm.

The breach was uncovered during an internal audit that revealed unauthorized transfers from Binance’s hot wallets. Security analysts determined that the attacker gained access to privileged credentials stored on the engineer’s device, allowing the movement of assets before the anomaly was detected.

According to the exchange, the compromised laptop served as a gateway to critical infrastructure. By extracting SSH keys and API tokens, the intruder was able to bypass multiple layers of protection and issue withdrawal commands that appeared legitimate to the system. The scale of the loss places the incident among the most costly crypto thefts on record.

Binance said it has launched a full forensic investigation and is working closely with law enforcement agencies across several jurisdictions. The company also indicated that it has already begun a comprehensive review of its internal security policies, including stricter device management, multi‑factor authentication for all privileged accounts, and enhanced monitoring of anomalous activity.

The episode adds to a growing list of high‑profile attacks on cryptocurrency platforms, where attackers increasingly target insider access points rather than solely exploiting external vulnerabilities. Past incidents at other exchanges have highlighted the challenges of safeguarding digital assets that reside in hot wallets, which must remain online to support trading but are also more exposed to theft.

Industry observers note that Binance’s swift attribution of the loss to a single compromised workstation may help restore some confidence among users, but regulators are likely to scrutinize the exchange’s risk controls more closely. The firm has pledged to compensate affected customers in accordance with its insurance policies and to implement additional safeguards to prevent a recurrence. The investigation remains ongoing, and further details are expected as forensic teams continue to piece together the attack chain.