The largest theft ever recorded did not involve breaking any encryption, cracking any password vault or stealing the keys to a single wallet. The attackers got the victim's own systems to approve the transfers, and then moved faster than any person could react.
That is worth understanding even if your business has never held a cryptocurrency, because the same group spends much of its time on companies that look a lot more like yours.
What happened
The preparation was patient. According to the blockchain analysis firm TRM Labs, the wallet the attackers would operate from was funded through the Tornado Cash mixing service at least 36 hours before the theft, and early on 29 October they tested their code against two wallets and then rehearsed once more on a third.
The theft itself was fast. Shortly after 20:05 UTC, five Binance wallets on the XRP Ledger began sending funds out. Between 20:20 and 20:24, 18,270 bitcoin left. On Ethereum, a single transaction carrying fifty pre-signed authorizations handed control of one of Binance's hot wallets to the attackers' code, which emptied it of ether and dozens of other tokens three and a half minutes later. Most of the money was gone across ten blockchains in about twenty minutes. A smaller second wave on two more networks ran until shortly before midnight.
Binance's first public explanation, early on 30 October, said a "compromised DevOps engineer's laptop" had let the attacker reach an internal service and "submit unauthorized withdrawal transactions." It later said its investigation had "uncovered additional points of breach." Co-CEO Richard Teng described a complex attack involving malicious software built to delete evidence of its own activity, and said it was "not a single 'one-click' action" and did not pass through the company's normal approval controls. Binance has not yet published a full root cause.
On 31 October the FBI said North Korea was responsible, named the TraderTraitor operation and published more than 600 addresses it asked the cryptocurrency industry to block. Analysts at Chainalysis had reached the same conclusion within hours, partly because stolen funds were being mixed with money from a September theft from another exchange, Bitget, already attributed to North Korea.
They did not steal the keys. They borrowed the signature.
The detail that matters most is what the attackers did not need. Binance said it found no evidence of a private key leak, and analysts agree. As Elliptic put it, the attacker "appears to have been able to get Binance's own systems to sign transactions on their behalf."
That is a different kind of failure from the one most security spending protects against. The keys were safe. The approval process was intact on paper. But the system that applied the approvals was reachable from a compromised employee device, and once the attacker was inside it, every transaction it produced was, technically, legitimate.
The Bybit theft in February 2025 followed the same pattern: a developer's machine at a supplier was compromised, and the interface that staff used to approve transfers was quietly altered. In both cases the organization's controls did exactly what they were built to do. They were just being operated by someone else.
Every business has a version of this. Your bank requires two approvals for a large payment, but both approvers log in from laptops. Your accounting system checks invoices against purchase orders, but someone with admin access to that system can change either. A control is only as strong as the most exposed device that can operate it.
Speed, and what speed saved
Twenty minutes is not a window in which a person notices something, escalates it and stops it. Whatever stops a theft at that speed has to be automatic.
What happened next is the encouraging part. Stablecoin issuers such as Tether and Circle can freeze their own tokens, and by roughly an hour after the theft began they had started doing so. Analysts now count about $2.85 billion frozen, roughly 44% of what was taken. Nearly all of it was frozen because a third party could act quickly on funds it controlled, not because Binance could pull anything back itself.
The lesson carries straight over to ordinary payment fraud. When a business wires money to a criminal, the chance of recovering it depends almost entirely on how quickly the bank is told. Hours matter. Days usually mean the money is gone.
North Korea's other line of business: your hiring process
North Korea's cyber operations exist to raise money, and crypto theft is only one channel. The other is getting hired.
In October the FBI warned that North Korean IT workers are increasingly paying American "facilitators" to host company laptops, spreading those laptop farms across more locations and renting established professional networking accounts to look credible. That same week the US Justice Department charged 14 people over schemes that placed workers at more than 70 US companies across 17 states. On 28 October the Treasury sanctioned a further ten individuals and one company over the same schemes.
The recruiting runs the other way too. A joint advisory from Japan, the United States, Australia and Germany in September described a campaign of fake job interviews that infected at least 30,000 devices in more than 100 countries, using AI face-swapping on video calls. Earlier this year researchers found North Korean operators had registered a fake company in Mexico to make their job offers look legitimate.
It has not been disclosed how the Binance engineer's laptop was compromised, and we would not guess. But the pattern across this group's earlier cases is consistent: the first step is usually a person, approached as a candidate, a recruiter or a colleague, not a piece of software.
What to actually do
Treat administrator devices as the crown jewels. The laptops that can reach your payment systems, your Microsoft 365 or Google admin console, your servers or your accounting software deserve more protection than the rest. That means separate admin accounts used only for admin work, no personal browsing or side projects on those machines, and endpoint protection that someone actually monitors.
Put the approval somewhere the attacker cannot reach. Use your bank's own dual-authorization for payments, so the second approval happens on the bank's system rather than inside one of yours. Verify any change of payee bank details by calling a number you already had, never one in the email asking for the change.
Keep less money in the hot account. Binance's losses came from wallets kept online for daily withdrawals. Your equivalent is the account that payments go out from. Keep it funded for operating needs, sweep the rest to an account that requires more steps to move, and set daily limits with your bank.
Know who you are hiring. For remote roles, insist on live video with the camera on, verify identity documents, ship equipment only to an address you have verified, and be suspicious of a new hire who asks to have a laptop sent elsewhere. Apply the same care to contractors and agencies who supply remote staff.
Warn your technical staff about recruiters. Developers and IT staff should never run a "coding test" or install software sent by a recruiter on a work machine. If they want to look at it, a disposable virtual machine is the place.
Decide who calls the bank, before you need to. Write down who contacts your bank's fraud line if a payment goes wrong, and make sure they can do it within the hour, including evenings and weekends.
The summary
Binance can absorb a $6.3 billion loss; it had set aside reserves and insurance funds for exactly this, and its customers are being made whole. Almost no other organization could survive a theft of that proportion.
The point for everyone else is not the size. It is the method: one compromised device, controls that were perfectly sound until someone else was operating them, and a theft finished before any human could respond. Protect the devices that can approve things, put the final approval out of an attacker's reach, and be as careful about who you let in as you are about what software you install.
Sources
- Binance security incident update — Binance, 30 October 2026 (update 2, update 3, update 4)
- North Korea responsible for $6 billion Binance attack — FBI
- North Korea steals $6.36 billion from Binance in the largest hack in history — TRM Labs
- Binance exploit: latest findings and response — Chainalysis
- The Binance hack: the largest in history — Elliptic
- FBI says North Korea was behind $6 billion Binance crypto hack — Reuters, via NBC News
- Binance pauses withdrawals as hackers suspected of stealing billions in crypto — TechCrunch
- North Korean IT workers: public service announcement — FBI, 13 October 2026
- North Korean WaterPlum hackers infected 30,000 devices worldwide — BleepingComputer
- North Korean hackers siphon $12 million from crypto users — The Record
