North Korean Group Suspected in $6.3 B Binance Crypto Theft via Compromised DevOps Laptop
What Happened — Binance confirmed that attackers moved roughly $6.3 billion in cryptocurrency from its platform, making it the largest crypto‑theft on record. Investigators traced the breach to a compromised laptop belonging to a DevOps engineer. The intruders leveraged the machine to gain access to a service container that holds the exchange’s payment‑signing system, then abused the Ethereum EIP‑7702 feature to authorize transfers across multiple blockchains within minutes. Binance has frozen about $3 billion of the stolen funds, reserved $6.34 billion to cover losses, and is currently halting withdrawals while it rebuilds the withdrawal service. The attack is attributed to the North Korean “TraderTraitor” unit, which previously targeted Bybit in 2025.
Why It Matters for Trust & Control Assurance — The incident highlights the critical need for robust privileged‑access controls and continuous monitoring of high‑value service accounts.
Who Is Affected — Global cryptocurrency exchanges, fintech platforms, and any organization that manages high‑value digital assets or uses privileged service accounts.
Recommended Actions
- Conduct an immediate audit of privileged accounts and service‑container permissions.
- Enforce multi‑factor authentication and hardware‑based keys for all DevOps workstations.
- Implement continuous, tamper‑evident logging of signing‑key usage and enforce separation of duties.
- Rotate all compromised signing keys and review EIP‑7702 usage policies.
- Map these actions to the “access control” control objective in your audit framework.
Technical Notes
- Attack vector: stolen credentials from a compromised laptop → unauthorized use of payment‑signing system.
- Exploited Ethereum EIP‑7702 (introduced May 2025) to delegate wallet control to malicious code.
- No public CVE; the weakness lies in operational security and key management.