The Binance Hack: How One Laptop Led to a US$6.3 Billion Theft

The Binance hack is the largest crypto theft on record. On 29 October (the morning of 30 October here in Sydney), crypto exchange Binance lost an estimated US$6.3 billion (around A$9 billion). Most of it left in about 20 minutes.

You might be thinking, “We don’t own any crypto, so what’s this got to do with us?”

Quite a lot, actually. Not because of the crypto, but because of where it appears to have started: one staff member’s laptop.

What happened in the Binance hack, in plain English

Here’s what has been confirmed so far:

• The money moved fast. Starting around 7am on 30 October Sydney time, funds were drained from Binance’s online (“hot”) wallets across ten different blockchains. Blockchain analysts TRM Labs say most of it went in about 20 minutes.
• It may have started with one laptop. Binance says its initial investigation suggests a compromised laptop belonging to one of its DevOps engineers (the people who keep its systems running) gave the attacker a way into the part of the system that submits withdrawals.
• But it wasn’t one click. Binance has since said the incident stems from multiple factors and that it found additional points of breach. In other words, the laptop may have been the way in, but it wasn’t the whole story.
• The keys weren’t stolen. Binance says it found no evidence its wallet keys were leaked. Analysts believe the attacker got Binance’s own systems to approve the transactions.
• About half was frozen. Partners froze about US$3 billion, much of it within an hour.
• Who did it? Several blockchain analytics firms point to a North Korean hacking group. No government had confirmed that at the time of writing.
• Customers are being covered. Binance says it will cover all losses from its own funds (iTnews has a good summary).

What we don’t know yet is how the laptop at the centre of the Binance hack was compromised. Binance has promised a full technical report. Until then, ignore the rumours doing the rounds on social media.

Why the Binance hack matters to a 20-person business

Many attacks on businesses don’t start with someone “hacking the server”. They start with a person: their laptop, their email or their login.

Once an attacker is on one device, they use whatever that person already has access to. Saved passwords. Logged-in sessions. Admin rights. Shared drives. From there they look for the next door.

Binance is one of the best-resourced companies in the world, with a large security team. If one compromised device can be the starting point of the Binance hack, it can be the starting point anywhere.

Six lessons from the Binance hack for your business

These apply to any business, crypto or not.

1. One device can be the front door to everything

The laptops that matter most are the ones belonging to people with the most access: whoever looks after your IT, your finance team, and you.

What to do:

• Give admins a separate admin account that’s only used for admin work, never for email or web browsing.
• Keep the number of people with admin rights small, and check the list regularly.
• Make sure every work device is managed, kept up to date and running endpoint protection.

Restricting admin access is one of the ASD’s Essential Eight strategies for good reason. We cover the rest in our Essential Eight guide for small business.

2. MFA is essential, but it isn’t the finish line

Attackers don’t always need your password. If they can get onto your device, they can sometimes reuse a session that’s already logged in. In an earlier theft linked to the same North Korean group, the FBI says the attackers used session information to impersonate a compromised employee.

What to do:

• Use phishing-resistant MFA (passkeys, security keys or Windows Hello for Business) for admins and anyone who approves payments.
• In Microsoft 365, only allow company data on company-managed devices, so a stolen login on an unknown machine gets blocked.
• Shorten how long sessions stay logged in for high-risk accounts.

Need a hand with this? See our Microsoft 365 security services.

3. “The keys were safe” isn’t the same as “the money was safe”

In the Binance hack, the wallet keys weren’t stolen, according to Binance. Analysts believe its own systems were tricked into approving the payments instead.

Small businesses face the same problem on a smaller scale. If someone gets into an email account, they don’t need your banking password. They can send a convincing “please update our bank details” email from inside, or approve a payment that looks routine.

What to do:

• Put checks on the payment process itself, not just the logins: a second person approves new payees and large payments.
• Always confirm a change of bank details by calling a number you already have, never one in the email.
• Set sensible daily limits in your banking.

Our email security services help stop the fake emails before they arrive.

4. Be wary of the “job offer” and the “quick test”

We don’t yet know exactly how the Binance hack began. But the North Korean group analysts have named has a well-documented favourite trick. US authorities have warned since 2022 that it sends recruiter-style messages offering high-paying jobs to IT and DevOps staff, then asks them to download a “test” or app that’s actually malware.

The small business version looks like an unexpected LinkedIn message, a “please review this document” link, or a file from someone you’ve never dealt with.

What to do:

• Work devices are for work. Job hunting, side projects and personal downloads belong on personal devices.
• Make it easy and blame-free for staff to say “I think I clicked something”.

5. Speed matters, so have a plan

About half the money taken in the Binance hack was frozen, much of it because partners acted within about an hour of the first transfers. The rest is still being traced.

For a small business, the first hour after something goes wrong makes a big difference too. Can you cut off a compromised account straight away? Is someone watching security alerts, including after hours? Does everyone know who to call?

What to do:

• Use endpoint detection with someone actually watching and responding to the alerts. See our Managed EDR service.
• Write a one-page incident plan: who to call, how to lock accounts, who talks to the bank. Our cyber incident response page explains how we help.

6. Expect the scam wave after the headline

Every big breach is followed by scammers, and the Binance hack is no different. Expect fake “refund”, “compensation” and “your account was affected” messages, by email, SMS and phone. Binance has told customers to rely only on its official channels.

This isn’t new in Australia. Last year the AFP and the ACCC’s National Anti-Scam Centre warned more than 130 Australians about scammers impersonating Binance by text message and asking for their wallet recovery phrases.

The same applies to any big news story about a bank, telco or software company your business uses. Remind your team:

• Never share passwords, MFA codes or recovery phrases, no matter who asks.
• Don’t click links in “urgent” messages. Go to the official website or app yourself.

A 15-minute check for your business

Use the Binance hack as a prompt. Sit down with whoever looks after your IT and ask:

1. Who has admin rights, and do they use a separate admin account?
2. Can company data be accessed from personal or unmanaged devices?
3. Is MFA on everything, and is it phishing-resistant for admins and finance?
4. Is someone watching security alerts outside business hours?
5. Do new payees and bank detail changes need a second check?
6. Do we have a written plan for the first hour of an incident?

If any of those answers is “not sure”, that’s your starting point.

If something looks wrong

Don’t sit on it. Disconnect the device from the network, reset passwords from a different device, call your bank if money is involved, and report it through ReportCyber or call 1300 CYBER1 (1300 292 371). Scams can also be reported to Scamwatch.

The bottom line

The Binance hack, the biggest crypto theft in history, appears to have started with one laptop. It was a carefully planned attack, but the way in appears to have been an ordinary work device.

You don’t need Binance’s budget to protect your business. You need to know who holds the keys, put a second check on the things that move money, and make sure someone notices quickly when something isn’t right.

If you’d like a hand checking yours, get in touch or call us on (02) 8212 4722.

Frequently asked questions about the Binance hack

What happened in the Binance hack?

On 29 October 2026, attackers moved an estimated US$6.3 billion out of Binance’s online wallets across ten blockchains, most of it in about 20 minutes. About US$3 billion was frozen, and Binance says it will cover customer losses.

How did Binance get hacked?

Binance’s initial investigation suggests a compromised DevOps engineer’s laptop gave the attacker access to a system that could submit withdrawals. Binance says multiple factors were involved and has promised a full technical report.

What can small businesses learn from the Binance hack?

Protect the devices of people with the most access, use phishing-resistant MFA, put second checks on payments, watch for fake job offers and downloads, have an incident plan, and expect scam messages after big breaches.