Binance traces breach to an engineer's laptop and finds more ways in

Binance now says its record $6.3 billion breach may have started with a single compromised computer. The exchange believes attackers used the hacked laptop of a DevOps engineer to reach its internal infrastructure.

What happened

Chief executive Richard Teng said the investigation has found additional points of breach beyond the first one identified. In his words, the attack was “not a single ‘one-click’ action.” He said the hackers erased evidence as they went and got around the exchange’s security checks.

Binance says about $3 billion of the stolen assets has been frozen. The exchange is aiming to restart withdrawals on Sunday and plans to publish its proof of reserves on Monday.

Background

DevOps engineers manage the systems that run and deploy an exchange’s software. That often gives their machines access to sensitive internal tools. Attackers who target crypto firms frequently go after individual staff, using fake job offers, malicious files or poisoned software packages, because one infected device can open a path to far more valuable systems.

The detail that evidence was erased matters for investigators. It makes it harder to reconstruct exactly which systems were touched and in what order, and it may explain why new points of entry are still being found days later.

Why it matters

If the breach did begin on one employee’s laptop, the lesson reaches well beyond Binance. Every large exchange depends on staff who hold some level of access, and security is only as strong as the weakest machine in that chain.

For customers, the next milestones are concrete: whether withdrawals resume on Sunday as planned, and whether Monday’s proof-of-reserves report shows that customer balances are fully covered.