Two Exchange Hacks in Three Weeks, Likely the Same Group: It Started With One Employee's Laptop

On October 30, onchain researchers reported that funds stolen from Binance and from this month's roughly $388M Bitget hack were moved through THORChain into the same address. Intelligence firms including TRM Labs and Chainalysis assess that both incidents were carried out by the North Korea-linked group TraderTraitor; Binance and law enforcement have not formally confirmed this.

Binance has since added that a compromised employee laptop was only the starting point, that the attack involved a more complex intrusion, and that no single device or single engineer's access was enough to move the funds. It has found no evidence of a private key leak, about $3B is frozen on-chain, and withdrawals are expected to resume within 48 hours. Our earlier articles on the EIP-7702 delegation and the DevOps laptop cover the first two days.

Where small teams are exposed

Five things you can do now

• Treat files, meeting links and coding tests from strangers as high risk. Use the company's own meeting tool for recruiting, investor and partner calls, never install software the other side asks for, and never run their code on a work machine
• Map the full path from an employee laptop to an outgoing withdrawal, and make sure at least two checkpoints are held by different people on different devices, so no single computer can open the whole path
• Give people who can reach production or signing a dedicated device, and keep everyday email, chat and browsing on a separate machine
• Build delay into outflows: large or unusual withdrawals wait automatically and notify a second person, so there is time to catch a problem
• Follow public threat intelligence on these groups, and add known fake recruiter accounts, malicious domains and malware indicators to your email, endpoint and DNS blocking rules

The shared address comes from public onchain tracing by researchers. The TraderTraitor attribution is an assessment by intelligence firms and has not been formally confirmed by Binance or law enforcement. The laptop being only the starting point and the withdrawal timeline come from Binance's statements; its technical post-mortem will be the reference. This article does not cover attack details.