The Binance hack exploited familiar weaknesses – all organisations should learn from it

Hackers have stolen around US$6.3 billion (£4.7 billion) from the cryptocurrency exchange Binance, most of which was taken in under an hour. According to Binance, the attack exploited systems and individuals with the authority to carry out transactions involving such large sums. Such vulnerabilities exist everywhere; statistics show that people and the systems they directly use, including their personal computers, remain a top target for cybercriminals. All organisations could therefore learn lessons from this attack. The Binance theft took place on the evening of October 29, 2026. The Binance attack netted four times the amount stolen in the previous biggest cryptocurrency theft, on the Bybit exchange in February 2025. Private keys, used to authorise spending or withdrawal from crypto-wallets, are a known vulnerability. But Binance found no evidence these were leaked. An initial statement from the exchange pointed to a compromised laptop belonging to an engineer. This gave the attacker access to the internal system that processes withdrawal requests. Because blockchain transactions can be fully audited, investigators can trace the events leading up to the attack. On October 28, the address from which the theft was later carried out received 0.3 ETH (Ether cryptocurrency) from Tornado Cash, a service that mixes funds from multiple users to hide their origin. A few hours before the theft, a malicious smart contract (computer code that automatically runs when certain conditions are met) was deployed from the same address. At 20:20:59 UTC, a transaction was sent from that address containing 50 signed authorisations intended to transfer control of a Binance wallet to that smart contract. One of them was accepted by a Binance hot wallet (a wallet used by the exchange to process customer withdrawals). Following this takeover, the hackers proceeded to empty the hot wallet of 64 different tokens worth approximately $2.5 billion (£1.8 billion) in a single transaction. Other wallets were then emptied in parallel using standard signed transactions, bringing the total amount stolen to $6.3 billion. Valid Binance digital signatures were needed for draining the wallets, but how the attackers obtained these has not been explained. The same audit trail shows that the attackers were rehearsing several hours earlier, but at that stage, nothing linked them to Binance. Familiar tactics The 2025 attack on Bybit, which resulted in the theft of US$1.5 billion (£1.1 billion), also appears to have involved a compromised laptop that was capable of performing operations requiring high-level privileges. North Korean cybercriminals, who were implicated in the attack on the Bybit exchange by analysts, specialise in creating so-called “legends”. These are identities created to deceive companies and individuals. In October, the US Department of Justice indicted 14 individuals in a case in which North Korean cybercriminals, using stolen or fabricated identities, secured remote jobs at more than 70 US companies. As of Sunday November 1, Binance had restored withdrawals for certain cryptocurrencies. Chinnapong / Shutterstock Two days before the attack, Binance reported that, for a week, it had been blocking North Korea-linked attack attempts involving fake recruiters. Was this related to the attack? We don’t know yet, but the modus operandi is well recognised and widespread. North Korea, meanwhile, has denied allegations that it was behind the attack. A cybercriminal can use a legend to pose for months as a hardworking employee, a cheap and reliable contractor, or as a generous employer. The criminal waits for the moment when a crucial software installation is carried out or a vital document is signed. Since a large amount of today’s work involves only digital interactions with people, it is sensible to approach every new contact with limited trust. A good example of how such legends work is the attack on the Japanese DMM Bitcoin exchange in 2024, which netted US$308 million (£230 million) for the attackers. The hacker posed as a recruiter on LinkedIn and gained the trust of a Ginco employee. Compromised laptops may have played a role in several cryptocurrency attacks. Aldabra Studio / Shutterstock Ginco is a company that provides DMM with wallet management software. The recruiter offered the Ginco employee a job on the condition that they completed a recruitment test. The test URL actually led to a malicious Python script; from this point on, the victim’s computer was compromised. This is classic social engineering. In this case, the target was a cryptocurrency wallet system accessed through a compromised computer. About two months later, the attackers drained funds from DMM. Lessons for business Virtually all businesses should learn from such attacks. The first lesson concerns what their computer systems are allowed to authorise. Traditionally, cryptographic keys are protected using devices known as hardware security modules and multi-signature schemes (where multiple private keys are required to authorise an action). Unfortunately, such mechanisms do not protect against an attack launched from a compromised internal system controlled by a hacker. It is advisable to define rules for authorising financial transactions, set time and amount limits, and require approval via an alternative channel for unusual requests. Additionally, since most of the funds in the Binance cyberattack were transferred within an hour, computer systems should have mechanisms in place to block suspicious transactions within seconds, without waiting for approval from the on-duty security engineer. The second lesson is about recruitment, which has evolved into a security mechanism. North Korean cybercriminals use stolen or fabricated identities and virtual private networks (VPNs) to pose as people living in the US. Visual identities during online interviews can be falsified using deepfakes. Video interviews and CVs no longer prove who someone really is. In some cases, actors are even hired for in-person interviews. Today, we need to focus on strengthening the identity verification process. It’s important to check candidates through independently verified contacts during this process. The third lesson concerns the work computers of individuals with privileged access to the computer system. Typically, organisations have protected themselves against phishing through training and email filters. Unfortunately, some of the attacks described above bypass the filters that are currently in use because they target specific victims (an act known as spear phishing). In the case of Bybit, gaining access to a developer’s computer allowed the attacker to seize session tokens in the cloud and bypass multi-factor authentication. One possible solution is to separate privileged access from day-to-day operations. To this end, access to withdrawal systems should only be permitted from company-managed dedicated devices, and computer code received from external sources should only be executed in an isolated environment. The largest cryptocurrency theft in history is essentially a story about how people and processes are the weakest links in security systems. Cryptography was not compromised and remains a key security measure. Unfortunately, these same vulnerabilities exist in banks, payment companies and hospitals and attackers are well aware of them.