#cryptocurrency

Binance has published an incident report on the theft of about $6.3 billion on October 29, which TRM Labs calls the largest cryptocurrency theft on record. According to The Register, the FBI attributed it over the weekend to TraderTraitor, a North Korean operation linked to the Lazarus Group; TRM and Chainalysis had already named the same unit.

Binance describes a months-long intrusion, not a single phishing email. In June an engineer downloaded a malicious Homebrew installer; staff caught it and replaced the device. In September a second engineer was approached on a job-hunting platform and taken through fake interviews, the last with someone posing as a CEO who asked them to download a code "assignment" that carried malware. On October 20 the attackers used that machine and an internal AI tool to reach two wallet engineers' computers, and on October 29 they used a stolen container-deployment token to launch the theft.

TRM told WIRED the wallets on at least ten blockchains were drained in about 20 minutes, after test runs on smaller wallets. Binance says it will cover all losses and has rebuilt the wallet system and the AI tool.

When Binance reopened withdrawals on Sunday, November 1, it processed $4.65 billion out and $1.01 billion in, for $3.64 billion in net outflows (about 2.1% of its $171 billion in assets), CNBC reports. Bitcoin slid about 4% on Friday, less than the 8.3% average first-day drop after past exchange hacks, per Anchorage Digital data cited by CNBC.

Keystone, a maker of crypto hardware wallets, said on October 26 that an attacker who got into its website obtained the key its devices use to prove they are genuine, according to The Hacker News. With that key, someone could build counterfeit wallets that pass Keystone's online check; a buyer who trusted one could lose their crypto. Keystone says the key plays no part in recovery phrases, private keys or signing transactions, and it has not reported any counterfeits or thefts.

Because the key is burned into each device during manufacturing and can't be changed, Keystone will destroy 18,835 unsold units and give new devices a new key. Devices delivered before October 20 that pass the check can be used normally; owners of devices received after that should contact support before using them.

The attacker used a flaw in a third-party monitoring tool on Keystone's website and also took 25,964 buyer records (names, contact details, shipping addresses, orders) from 2024 to 2026 purchases.