From Bybit to KelpDAO to Binance: What Three Record Thefts Have in Common

This post reflects public reporting through November 13, 2026. Investigations are ongoing, and attributions come from the sources named below. Where a detail is reported but not confirmed, we say so.

Three major crypto thefts happened in February 2025, April 2026, and October 2026. Two of them were the largest on record when they happened. They are linked by more than their size. All three have been attributed to the same North Korea-linked group, known as TraderTraitor. And in all three, the reported way in wasn't a clever flaw in the code that holds the money. It was closer to stealing the keys to the building than picking the lock on the vault.

Bybit, February 2025: about $1.5 billion

On February 21, 2025, roughly $1.5 billion in Ether and related tokens left Bybit's cold wallet, the offline wallet an exchange uses for long-term storage. Investigators concluded the attackers had broken into a developer's computer at Safe{Wallet}, the company whose wallet software Bybit used, and used that access to change what the wallet showed on screen. Safe stated that its smart contracts were never breached. The screen showed one transaction while the people approving it were actually signing off on another. The FBI attributed the theft to North Korea, under the name TraderTraitor.

The way in: a developer's computer, then a trusted piece of software that people used to approve transactions.

KelpDAO, April 2026: about $290 million

On April 18, 2026, KelpDAO lost roughly $290 million. The attackers didn't break KelpDAO's contracts. They went after the system that confirms messages arriving from other blockchains, which was run on LayerZero's network. According to LayerZero and Chainalysis, the attackers took over two of the servers that feed blockchain data to the checker, made them report false information, and flooded the remaining servers with traffic so the checker had to rely on the compromised ones. KelpDAO's setup used a single checker, so once that one was fooled, nothing else stood in the way.

LayerZero said the theft was likely the work of the same group, TraderTraitor, and called that attribution preliminary. KelpDAO paused its contracts, which blocked a second attempt worth about $95 million. The two companies dispute who was responsible: LayerZero says KelpDAO chose a single checker against its advice, and KelpDAO says it used the standard setup and did not run the servers that were compromised.

The way in: compromised servers feeding a single checker, with no second checker to catch it. Not a math error in the code.

Binance, October 2026: about $6.3 billion

On October 29, 2026, Binance lost what it estimates as $6.3 billion. Its preliminary findings point to a compromised laptop belonging to one of the engineers who run its systems. The laptop was used to reach an internal service and submit withdrawals nobody had authorized. Binance has said there were additional points of breach. The FBI attributed the theft to North Korea and TraderTraitor. On November 12, Binance said it had finished replacing all affected customer assets from its own funds, and the US Justice Department said it had court authorization to seize or restrain more than $1.2 billion of the stolen cryptocurrency. We covered the details in our Binance post.

The way in: a laptop, then an internal service with the power to move funds.

The pattern

None of the three, as reported, began with a flaw in smart contract code. They began with:

• People and their devices. A developer's computer, an engineer's laptop.
• Trusted tools and systems. The screen used to approve transactions, the network that checks messages between blockchains, an internal service.
• Setup and permissions. A single checker with nobody to double-check it, a service allowed to submit withdrawals.

CertiK has made a similar observation about this year's largest breaches: they came from stolen logins and compromised devices, not from flaws in code. OWASP's smart contract research reflects it too. It keeps a separate list of attacks that happen outside the contract code.

What it means for a team running a crypto product

Treat the systems that check and approve transactions as targets. If your product relies on an outside service to confirm messages, pass them along, or display what you're approving, ask what happens if that service is compromised. Any setup where one failure is enough to lose everything is a problem worth reporting.

Know what you're signing. A screen can lie. For high-value transactions, check the details through a second, independent tool, and use hardware wallets that show what is actually being approved.

Lock down developer computers and release systems. If a compromised laptop can reach a service that moves money, that laptop is your real front door. Give each person and each system only the access it needs, split sensitive jobs between people, and require approvals that don't depend on one person or one machine. Each of those limits how much damage a single break-in can do.

Plan to detect and freeze. Speed decides how much is recovered. Know who can pause your system and how fast.

Don't stop at the contract audit. A code review is essential, and it won't cover any of this. Our dapp security reviews look at the supporting services, the handling of keys, and the release process around your contracts. A design review can catch a single point of failure before it's built.

If you'd like us to look at the parts of your system that sit outside the contracts, get in touch.

Sources: BleepingComputer on the Bybit compromise, The Block, FBI statement on Bybit, Security Affairs on KelpDAO, Chainalysis on KelpDAO, BleepingComputer on Binance, CBS News on the FBI attribution, US Justice Department announcement, The National on CertiK's observation, OWASP Smart Contract Top 10.