Binance, the world’s largest cryptocurrency exchange by trading volume, has confirmed that attackers stole an estimated $6.3 billion (around £4.7 billion) in digital assets on Thursday evening, in what is now the largest cryptocurrency theft on record. The figure is roughly four times the $1.5 billion taken from Bybit in February 2025, the previous record-holder.
According to blockchain intelligence firm TRM Labs, funds began leaving Binance wallets at around 20:05 UTC on 29 October, spread across ten blockchains including Ethereum, Bitcoin, Tron, the XRP Ledger and Solana. Most of the money was gone within roughly 20 minutes. Binance suspended deposits and withdrawals and, by late Thursday, said around $3 billion had been frozen with help from stablecoin issuers, partners, and law enforcement. Tether and Circle alone froze more than $2.5 billion in USDT and USDC.
Binance’s preliminary findings point to a compromised DevOps engineer’s laptop, which the exchange says gave an attacker access to a service container that could submit withdrawals. The company says it has found “no evidence of any wallet private key leak” and has promised a detailed technical post-mortem once its investigation concludes. Co-CEO Yi He said the exchange would cover all hacking losses, drawing on its Secure Asset Fund for Users (SAFU) and company funds.
Markets reacted quickly. Bitcoin fell around 5% to below $77,000 in the hours that followed, while Binance’s own BNB token dropped about 8%.
The vault held. The process didn’t.
For security professionals, the size of the theft is only part of the story. What sets this incident apart is where the attackers chose to strike.
“I’ve followed a lot of crypto thefts, and the Binance attack stands out less for the money than for how it was done,” said Jayant Dave, APAC CISO at Check Point. “The attackers didn’t break the encryption or steal the private keys. They took over the system that tells the keys what to sign.”
Dave continued: “Binance’s early findings for now point to one compromised engineer’s laptop. From there, the attackers reached a service that could submit withdrawals, and billions moved within minutes. That’s the lesson: a strong vault doesn’t matter if someone controls the process that opens it.”
TRM’s on-chain analysis supports that reading. On Ethereum, the attacker used EIP-7702 authorisations to make a Binance hot wallet execute a sweeper contract under their control, while the other nine chains saw ordinary signed transfers within the same window. TRM assesses that Binance’s hot wallet signing infrastructure was likely compromised, though the exchange has not yet published a root cause.
“The Binance attack raises an important question about how organisations protect their most valuable assets,” said Simon Pamplin, CTO at Certes. “If attackers can move billions of dollars without obtaining the private keys themselves, we need to examine the systems and trusted processes that gave them the ability to authorise those transactions.”
Samuel Hassine, CEO and co-founder at Filigran, agreed that the mundane nature of the entry point is what organisations should focus on. “The record figure will get the headlines, but the ordinary foothold is the lesson,” he said. “Binance says the attack may have started with a compromised engineer’s laptop, used to reach a service that submits withdrawals. It has since found further points of breach. By its own account, no wallet keys were stolen.”
Entry point or root cause?
Those further points of breach matter. Several experts cautioned against reducing a multi-billion-dollar compromise to a single infected device before the full investigation is complete.
“A compromised laptop may explain where an attack started, but it does not, on its own, explain how billions of dollars could leave an exchange,” said Pieter Arntz, researcher at Malwarebytes. “The real question is what allowed that initial foothold to become access to withdrawal systems — and which safeguards failed to stop unauthorised transactions.”
Arntz added: “Until the technical investigation is complete, blaming a single laptop risks confusing the entry point with the full cause of the breach.”
Certes’ Pamplin made the same point. “Initial reports of a compromised engineer’s laptop are significant, but Binance has already indicated that the intrusion involved additional points of breach. The investigation will need to establish how that initial access developed into the ability to initiate withdrawals at this scale,” he said. “The distinction matters because compromising a system that can legitimately instruct transactions may be just as damaging as stealing the credentials or keys used to secure it.”
For Pamplin, that is where long-held security assumptions start to break down. “This is where conventional security assumptions become dangerous. Organisations can have encryption, authentication and access controls in place, yet remain exposed if a compromised application or authorised process can operate within those controls. The real question is what an attacker can reach, read or instruct once that trusted environment is compromised.”
“It reportedly only took one laptop”
Whatever the full chain of events turns out to be, the image of a single endpoint leading to billions in losses has struck a nerve.
“Billions of dollars have been stolen from Binance in a matter of minutes by hackers taking control of the process that authorises withdrawals. And it reportedly only took one laptop,” said Chris Dimitriadis, Chief Global Strategy Officer at ISACA. “It’s a stark reminder that you can spend a fortune protecting your most critical systems, but if just one device is compromised, then your security is only as strong as the weakest machine on the network.”
Camellia Chan, CEO and co-founder of X-PHY, put it bluntly: “The biggest cryptocurrency heist in history may have started with a single compromised laptop. Such is the sophistication of hackers, that that’s all it can take.” She added that “Attackers are constantly looking for ways in, and for organisations handling sensitive financial information or critical infrastructure, employee laptops are particularly valuable targets.”
“The reported cyberattack on Binance is staggering in both its scale and potential consequences,” said Jamie Akhtar, CEO and co-founder of CyberSmart. “The fact that cybercriminals were reportedly able to move billions in digital assets in a matter of minutes demonstrates just how devastating a successful attack can be.” For businesses, he said, “this is a powerful reminder that even the largest organisations with significant cybersecurity resources are not immune to attacks.”
Jake Madders, co-founder and director of Hyve Managed Hosting, framed the incident as a question of access rather than defences. “The cyberattack affecting Binance highlights how attackers don’t always need to break through the front door. Sometimes, they simply exploit the people and systems already holding the keys,” he said.
“Binance says initial checks suggest a compromised engineer’s laptop may have given attackers access to internal systems, enabling unauthorised withdrawals. This raises important questions about how access to critical systems is managed. Protecting where assets are stored is not enough if the routes into them are not equally secure.”
The North Korea question
TRM Labs has attributed the attack “with high confidence” to TraderTraitor, a North Korean state-backed hacking unit linked to the Lazarus Group. The firm points to small Tornado Cash withdrawals used to fund an operator wallet the day before the theft, along with staging and pre-obtained signatures that echo earlier DPRK-linked heists. Independent investigator ZachXBT has also named Lazarus as the likely attacker.
“Blockchain analysts have linked the attack to TraderTraitor, the North Korean state-backed group behind the 2025 Bybit theft,” said Check Point’s Dave. “Governments haven’t confirmed that yet, but it fits a group that goes after people and processes, not cryptography.”
Binance is not the only major exchange hit this autumn. In September, Bitget lost close to $388 million in a breach its chief executive also blamed on North Korea. “This attack isn’t a one-off either – five weeks ago, Bitget lost around USD 388 million the same way: keys untouched, control layer abused,” Dave said. “Two major exchanges in just over a month is a trend we cannot ignore.”
Tim Rawlins, senior adviser and security director at NCC Group, said the targeting of a development engineer fits a well-established pattern. “This attack, reportedly on a development engineer, highlights that security is a critical element of every operational stage and personnel level. When security failures in trusted identities and administrative access can be targeted, attackers can exploit more than just the underlying technical vulnerabilities,” he said.
“Given what we know about the activities of countries like North Korea in targeting cryptocurrency, it’s unsurprising that attackers are prepared to invest considerable effort in targeting individuals who have access to the building blocks of the exchanges.”
Rawlins also flagged the role of artificial intelligence in accelerating these campaigns. “The increasing use of AI in attacks is supporting attackers to chain issues together in a way that might take them longer alone. Organisations are facing adversaries who are prepared to invest time and money to compromise their systems, if the return is large enough.”
ISACA’s Dimitriadis echoed that view: “Hacker groups are often well resourced and patient, and they know how to target people. Organisations, particularly in financial services, that hold high-value assets must assume a breach will happen and plan for it ahead of time.”
The stakes go beyond the exchange itself. TRM’s head of global policy, Ari Redbord, described the attack as “unprecedented”, warning that “When North Korea steals at this scale, the money funds weapons proliferation and other destabilising activity.”
Not just a crypto problem
It would be easy to treat the incident as a niche concern for crypto traders. Experts warn that would be a mistake.
“For the public, the message is uncomfortable but important,” said Muhammad Yahya Patel, vCISO and cybersecurity advisor for EMEA at Huntress. “Your crypto holdings, your investment portfolio, and your pension fund’s exposure to digital assets can all be materially affected by a security failure at an institution.”
Patel said the market reaction in the hours after the theft showed how far the consequences can travel. “When a cybersecurity incident sends shockwaves through crypto global markets, cybersecurity stops being a tech problem and starts being a systemic financial risk.”
CyberSmart’s Akhtar agreed: “Beyond the financial losses, an incident of this magnitude raises serious concerns about the security of digital financial infrastructure and the potential consequences when highly sophisticated attackers gain access to critical systems.”
For Check Point’s Dave, the same weakness exists well outside the crypto sector. “This goes well beyond crypto. Banks, payment providers, cloud platforms: any organisation whose automated systems move money or data on instruction carries the same risk,” he said. “Attackers have learned that the shortest route to the crown jewels often runs through one employee’s laptop and a trusted internal service.”
Ordinary users also face knock-on risks. “This incident affects trust in cryptocurrency as a whole,” said Dimitriadis. “And high-profile incidents like this are often exploited by hackers on other platforms to trick users into taking immediate action that could compromise their crypto assets.”
Spencer Starkey, Executive VP EMEA at SonicWall, noted that exchanges have long been in attackers’ sights. “Cryptocurrency exchanges are a popular target for cyberattacks, as they hold large amounts of valuable cryptocurrency. Cybercriminals will target cryptocurrency exchanges to steal cryptocurrency, disrupt operations, or even manipulate cryptocurrency prices,” he said.
Starkey placed the Binance theft alongside a run of disruptive attacks closer to home. “Look at the last few weeks. Hackers pushed supermarket fridges across Europe to 50C, destroying food and starting fires. Criminals stole Legal Aid Agency records going back decades, including probation data. A GP dispensary couldn’t order medicines. Cybercriminals won’t wait for procurement to catch up.”
Dimitriadis argued that responsibility for this kind of risk sits at the very top of an organisation. “This is ultimately a governance question, and it belongs in the boardroom, not just the security team. The fallout from an incident like this goes far beyond the money stolen – market confidence drops, customers move their assets elsewhere and regulators start asking questions.”
Closing the gap
So what should organisations that move money, or data, on instruction be doing now? The experts were broadly aligned: protect privileged people and devices, assume compromise, and make sure no single foothold can translate into unchecked authority.
“So, protect the people with the most access first,” said Dave. “Treat developer and admin devices as high-value targets. Assume any machine or credential can be compromised and make sure none of them can move large sums without an independent check.”
Speed and limits matter as much as prevention, he added. “Set hard limits on how much and how fast funds can move, and catch anomalies in seconds, not hours. Prevention has to come first, because once money spreads across multiple blockchains, getting it back is the exception.”
NCC Group’s Rawlins stressed the basics. “As we have seen with many of the attacks against crypto exchanges and other platforms, good cyber hygiene and effective security fundamentals are key to defending against attacks that many organisations are still missing,” he said. “Securing trusted identities so funds can’t be moved unchallenged or other privileges exploited comes down to having phishing-resistant MFAs, just in time privileged access, tightly scoped and monitored human and non-human identities, and detection in place for anomalous activities.”
Hyve’s Madders called for a stricter approach to access across the board. “The rule should be simple. People should only have access to the data and systems they need to do their jobs. This access should be tightly controlled, monitored, and removed as soon as it is no longer required. The same discipline must apply to external partners and third-party providers, whose access can create additional entry points for attackers.”
“The Binance incident shows why access management needs to be treated as a fundamental part of cybersecurity, not an administrative afterthought,” he continued. “Ultimately, strong security depends on understanding who has access and what they can reach, not just protecting what is behind the door.”
Certes’ Pamplin argued that controls need to sit closer to the transactions themselves. “Security needs to be enforced at the level of individual data flows and critical transactions, with cryptographic separation between systems and tightly controlled paths for sensitive operations. An attacker gaining access to one part of the environment should not automatically inherit the ability to move valuable assets across the rest of it.”
Filigran’s Hassine urged organisations to map and test their own exposure. “Any company whose systems move money on instruction should know exactly which machines and accounts can trigger a transfer. Assume one of them will be compromised one day, and test whether the controls behind it hold.”
CyberSmart’s Akhtar set out a similar checklist. “Protecting employee devices, implementing strong access controls and multi-factor authentication, and continuously monitoring for suspicious activity should be fundamental priorities. Organisations handling financial assets must also have additional safeguards in place, including strict transaction authorisation processes and controls that limit the damage a single compromised account or device can cause,” he said. “Employee cybersecurity awareness training is equally important, as attackers often exploit human vulnerabilities to gain their initial foothold.”
X-PHY’s Chan agreed that training is necessary but not sufficient. “Businesses can train employees to recognise the warning signs of a cyberattack and if their devices are compromised, but cybersecurity capabilities must also be built into every layer of protection, starting with the hardware itself.”
And for ISACA’s Dimitriadis, it comes back to leadership: “Good governance and building resilience mean the board treating cyber risk as a standing priority, investing in the right skills and making sure every employee is trained to recognise and resist targeted attacks.”
Freezes, compensation and the road to recovery
If there is a positive in the response so far, it is the speed with which a significant share of the stolen funds was frozen. “The estimated impact is around $6.3bn, four times the previous record. About $3bn was frozen within hours, with partners and law enforcement,” said Hassine. “That coordination is the part working well.”
The rest is a different matter. TRM estimates the attacker still controls more than $2.4 billion in ether and bitcoin, and has already begun moving funds through decentralised exchanges and lending protocols including Uniswap, Aave and JustLend.
“Credit to Binance for freezing funds quickly and committing to cover customer losses,” said Dave. “But the industry can’t keep relying on clean-up.”
Binance’s pledge to make customers whole is significant, because crypto users have far less protection than bank customers if an exchange cannot or will not pay. “Unlike money held in a UK bank account, which may be protected by the Financial Services Compensation Scheme (FSCS) up to £120,000 per eligible depositor, cryptoassets generally do not benefit from any equivalent compensation regime,” said James Broomhall, Senior Associate at Grosvenor Law.
“As a result, victims of major crypto thefts are often forced to pursue urgent tracing and recovery action through the courts, including Norwich Pharmacal applications to compel exchanges and other third parties to disclose information identifying fraudsters and tracing the movement of stolen assets.”
What comes next
Binance’s post-mortem should eventually show how a single endpoint became the ability to empty hot wallets across ten blockchains. Until then, much remains unknown.
“As the investigation develops, we’ll gain a clearer understanding of how this attack unfolded,” said Chan. “But the key takeaway for businesses is already clear: security needs to be built into the very foundations of their systems, because there are no limits to the depths attackers will go to find a way in.”
Pamplin agreed that organisations should not wait for the final report before acting. “The scale of this incident makes the consequences impossible to ignore. Security must be designed around the assumption that trusted systems can be compromised, with controls that prevent that compromise from becoming unrestricted authority over the assets they protect.”
Or, as Hassine put it: “Record thefts start with ordinary footholds.”
Dave’s warning may be the one that lingers longest: “The next attack will target the same weak point unless we close it first.”
