The exchange disclosed that attackers exploited a DevOps engineer’s compromised laptop to move about $6.3 billion, prompting an immediate freeze of transactions and a review of its security protocols.
Binance has halted all deposits and withdrawals after a compromised DevOps engineer’s laptop was used to siphon approximately $6.3 billion in crypto assets, the exchange announced on Monday.
What happened
The breach was traced to a single laptop belonging to a senior DevOps engineer who managed Binance’s internal deployment pipelines. Attackers gained remote access, leveraged the engineer’s credentials, and executed a series of unauthorized transactions that moved billions of dollars to external wallets.
How the breach unfolded
According to Binance’s security team, the malicious actors first installed a keylogger on the device, captured SSH keys, and then used those keys to authenticate to Binance’s internal APIs without triggering standard alerts.
- Compromise of the engineer’s laptop via a phishing email
- Extraction of SSH private keys and API tokens
- Creation of forged deployment scripts that initiated large withdrawals
- Transfer of funds to a network of mixing services before reaching final wallets
Binance’s response
In response, Binance immediately froze all inbound and outbound crypto flows, launched a comprehensive forensic investigation, and engaged third‑party cybersecurity firms to audit its DevOps environment. The exchange also announced a review of its credential‑management policies and a rollout of hardware‑based authentication for all privileged accounts.
For readers interested in broader industry context, see the Technology section on uxc.news, and learn how other platforms are tightening security by visiting Coinbase on Momentum.
We are taking decisive action to protect our users and restore confidence in our platform," Binance said in a statement.
Read the full details in the InfoSecPwn coverage of Binance breach.