Binance’s preliminary investigation into a recent security breach indicates that the attack originated from a compromised laptop belonging to one of its DevOps engineers. These engineers are responsible for maintaining the systems that support Binance’s services. From the compromised device, the attackers appear to have gained access to a service that can initiate withdrawals from user accounts.

Despite the breach, Binance has found no evidence to suggest that the private cryptographic keys securing its wallets were exposed or stolen. The investigation remains ongoing. According to Jayant Dave, Asia-Pacific chief information security officer at cybersecurity firm Check Point, the attackers did not directly break encryption or steal the keys. Instead, they took control of the system that authorizes transactions, effectively manipulating the mechanism that allows the keys to sign withdrawal requests.

This method of attack resembles a pattern seen in a 2024 incident involving North Korean hackers. In that case, the hackers masqueraded as recruiters on LinkedIn and tricked an employee of Japanese cryptocurrency software company Ginco into downloading a malicious file disguised as a coding test for a job application. The malware provided the attackers access to internal communications, enabling them to divert $308 million from the cryptocurrency exchange DMM Bitcoin.

Japan’s foreign ministry has previously warned that North Korea’s cyber force has evolved into a comprehensive national program, matching the sophistication associated with state-sponsored cyber operations from countries such as China and Russia. Reports indicate that North Korean hackers operate through extensive networks of operatives stationed in multiple countries, including China, Russia, and Southeast Asia, with estimates of their numbers reaching around 6,000 worldwide.