Binance traced the breach to a compromised DevOps engineer's laptop: the attacker reached a service container and submitted withdrawals, with no private key leaked. The hit is now about $6.3B, and ~$3B is frozen on-chain, up from $2.54B earlier.

The trail points to North Korea's Lazarus Group, which would make it the regime's biggest heist, topping the $1.5B Bybit attack. Some of the stolen funds reached the same THORChain address as loot from the $388M Bitget hack.

Binance will cover all losses from SAFU and company funds. Deposits work, withdrawals should resume within 48 hours, and today's PREDICT spot listing is postponed.