Threat IntelligenceSOC
Binance disclosed on 30 October 2026 that attackers stole roughly $6.3 billion in cryptocurrency, the largest crypto theft on record, and blockchain analysis firms attribute it to the North Korean group TraderTraitor. According to Cybersecurity Dive, both TRM Labs and Chainalysis link the intrusion to the group, and the previous record it displaced was North Korea's $1.5 billion Bybit breach. Binance has suspended deposits and withdrawals, says it will cover all losses, and reports that about $3 billion has already been frozen on-chain.
Binance's initial investigation, as reported by TechCrunch, found that the attack began on a compromised engineer's laptop. From there the attacker reached a service container and submitted unauthorized withdrawal transactions. Binance says it has seen no evidence that its private keys leaked — the attacker did not need them. Access to the system that submits withdrawals was enough.
How the laptop was compromised is not yet public. TraderTraitor's history offers likely candidates: the group is known for approaching engineers with fake recruiter messages and trojanized software, then riding the developer's own access into production. That makes this the same shape of incident as the firewall-to-directory pivot we covered yesterday: the breach is announced where the money or data left, but it is won or lost at an earlier hop that few teams watch closely.
The most practical detail in the reporting is the timeline. TRM Labs says preparation began at least 36 hours before the theft, including test runs that moved funds between attacker-controlled wallets, small Tornado Cash withdrawals that funded an operator wallet, and transaction signatures collected in advance. The execution itself — most of the $6.3 billion, moved across ten blockchains — took about 20 minutes.
That split matters for defenders in any industry. The 20-minute burst is essentially impossible to stop in real time. The 36 hours of staging before it is where detection is realistic: an engineer's endpoint behaving unusually, a service container receiving access it does not normally receive, signing operations happening outside the normal release or settlement rhythm. By the time the obviously malicious event happens, the window has closed.
The response was faster than in past heists. Binance reports roughly $3 billion frozen on-chain, and Chainalysis says a coalition of blockchain analysis and crypto firms traced and froze about half of the stolen funds. The FBI and the U.S. Secret Service have confirmed they are investigating. Elliptic also attributes the theft to North Korea and found that some funds moved to a wallet used in the $351 million Bitget attack earlier in 2026.
The figures are same-day reporting and may still change. Binance has said it will publish an updated proof of reserves after remediation, and it has not yet explained why one employee's laptop could reach infrastructure that controls billions of dollars.
The lesson here is not crypto-specific: the attacker was detectable for a day and a half before the loss event, on an endpoint and in a service container, not at the vault. Obiguard SOC is built for that earlier window — it correlates endpoint, identity and workload signals so that an engineer's machine reaching a system it never touches, or a privileged service acting outside its baseline, raises an alert while the attacker is still staging. Unlike yesterday's directory-enumeration case, where the signal was in identity logs, the signals here were on the endpoint and in the workload layer — SOC watches both, because the next incident will not announce in advance which layer it starts in.
If an attacker spent 36 hours staging inside your environment this week, moving carefully from one engineer's laptop toward your most privileged system, which of your alerts would fire first — and would it fire before or after the 20 minutes that matter?
Obiguard sits in front of every AI request your organization makes — screening prompts and outputs against the guardrails, compliance frameworks, and audit trails that stories like this one make necessary.
See how it works →