The Largest Crypto Theft In History. But How Did It Happen?
The hack has been attributed to state-sponsored actors by the name of TraderTraitor from North Korea.
The same group was responsible for the 2025 Bybit theft/hack of $1.5 billion; meaning they've broken their own record.
According to Binance's official updates the attackers didn't actually steal the cryptographic passwords/private keys, but instead gained entry to a Binance DevOps engeer's laptop. Likely this was done with a malicious script or malware of some kind.
This laptop held automated credentials for secure tunnels(SSH presumably?) connecting to internal Binance infrastrcuture.
Specifically, they gained access to an internal service container.
In modern cloud-deployments containers such as Docker or Kubernetes are the industry-standard way of shipping & developing sofware.
The complex infrastructure of modern websites & their numerous systems are broken up into micro-services via containers.
A container is similar to a virtual machine in many respects, but it's even further separated from physical hardware as it's not relying on a hypervisor.
Inside the container is everything necessary to the app/service to run, and nothing more. This makes them smaller,lightweight, and portable.
Once inside that container, the hacker simply tricked the automated system into signing off on and pushing through $6.3 billion in unauthorized withdrawal transactions directly to their own addresses.
Essentially, the hacker didn't break into the vault itself; they took over the digital workstation that tells the vault where to send the money.
What's even worse, this is very similar to how they pulled off the Bybit hack in 2025.
So, the hacker didn't break into the vault itself; they took over the digital workstation that tells the vault where to send the money.