One laptop away: What the $6.3 billion Binance hack teaches every business

Mo Mobasseri, CEO for QBS Technology Group META & Central Asia, discusses the recent Bianance crypto theft and potential measures that can be taken to shore up the security chain in this exclusive feature. 

One laptop away: What the $6.3 billion Binance hack teaches every business

On 29 October, roughly US$6.3 billion left Binance’s hot wallets in about 20 minutes. It’s the largest crypto theft on record, more than four times the size of the Bybit theft in February 2025, which held the record until last week.

I’ve worked in cybersecurity for more than 20 years, and the number isn’t what stayed with me. What stayed with me is how ordinary the starting point seems to have been: one engineer’s laptop.

What happened

Binance says unauthorised withdrawals hit its hot wallets on 29 October across ten blockchains, most of it within about 20 minutes (Wikipedia). It paused deposits and withdrawals, said user funds were safe and promised to cover every loss from its Secure Asset Fund for Users (SAFU) and its own money (U.Today). Stablecoin issuers such as Tether and Circle, along with other partners, helped freeze around US$3 billion on-chain (CNBC).

Things moved fast after that. On 1 November Binance began reopening withdrawals in phases, starting with Bitcoin, and by midday all 15 networks and assets in the first phase were back (Binance on X). It says it has already replaced about 95% of what was taken, using SAFU, part of its Futures Insurance Fund and company funds, and that customers won’t carry the loss (CoinDesk). About US$3.64 billion flowed out on the first day, which Binance puts at roughly 2.1% of the assets it holds. A full technical report hasn’t been published yet.

How the attack seems to have worked

Nobody broke the encryption, and there’s no sign of a smart-contract bug. From what Binance and analysts have shared so far, this was about access. Someone got hold of a trusted machine and used it as a stepping stone.

Binance’s early investigation points to a compromised laptop belonging to a DevOps engineer (SecurityWeek). How that happened hasn’t been disclosed. From there, the attacker reportedly reached a service container that could submit withdrawal transactions. TRM Labs says the groundwork took at least 36 hours, including funding the attackers’ own wallets through a mixer (Latin Times).

Then came the withdrawals, on ten chains at once. On Ethereum, analysts say the attackers used EIP-7702, a feature that lets a wallet hand its behaviour over to a smart contract, which left the wallet under the control of the attacker’s contract. On the other chains, the money simply went out in normal, properly signed transactions. After that it was a race, with the attackers splitting and moving funds while Binance, stablecoin issuers and other exchanges tried to freeze them.

Two details are worth holding onto. Binance says it has found no evidence that private keys were stolen. If that’s right, the attacker never needed the keys; they abused the systems that are allowed to ask for signatures (Bitdefender). Some outside commentators doubt this, and the final report should settle it. Binance has also said it found further points of breach beyond the laptop, without saying what they were. We don’t have the full picture yet.

We’ve seen this before

If you’ve followed the big crypto thefts of the last few years, the pattern will look familiar. Get to a person or a developer’s machine first, then use whatever access that machine already has.

Loss figures without a link are approximate, based on widely reported numbers.

What I notice every time is how often the way in is a fake recruiter or a “quick coding test”. These aren’t exotic zero-days. They’re conversations.

Where this kind of attack can be stopped

We don’t yet know what controls Binance had in place, so I’m not grading its security. What I can do is walk through the chain and point out where an attack like this can usually be broken, because every step is a chance to stop it.

Start with the laptop. Hardware security keys instead of codes, properly tuned endpoint detection, no local admin rights, and a firm rule that side projects, personal software and “job test” code never go near a work machine. Recruiter-style lures are this group’s calling card.

Then look at the gap between that laptop and production. Engineers shouldn’t be reaching production from the same device they use for email and browsing. Dedicated, locked-down admin workstations, access that’s granted just in time and expires within minutes, and recorded sessions all make a real difference.

Inside production, a service that can submit withdrawals should only accept requests from the specific services meant to call it, with signed requests and tight segmentation, not from anyone who happens to be authenticated.

At the signing layer, what a signer sees on screen should be checked independently against what’s actually being signed. Unusual destinations should need more than one approver, and any change to delegation or permissions, EIP-7702 included, should trigger an alert.

And at the treasury, keep hot wallets lean, set rate and velocity limits per chain, and build circuit breakers that pause outflows when something looks wrong. Losing billions in 20 minutes is a monitoring problem as much as an access problem.

If you run an exchange, or any business that moves other people’s money

I’d treat this week as a free stress test. These are the questions I’d be putting to my own teams.

1. If any one engineer’s laptop were compromised tonight, how much money could leave, and how quickly? Answer it for every privileged role.
2. Are the devices that build our software also the ones that run production and the treasury? They shouldn’t be.
3. Do our DevOps, wallet and treasury people know they’re targets? Fake recruiters, fake coding tests and fake collaboration requests sit behind several of the incidents above.
4. Can we independently verify what’s being signed, with multiple approvers and hardware-backed keys for high-value moves?
5. How small are our hot wallets, and what automatically pauses outflows when the numbers look wrong?
6. Have we rehearsed a freeze? About half of the stolen money here was frozen because stablecoin issuers, exchanges, analytics firms and law enforcement could be reached quickly. Those relationships have to exist before you need them.
7. Do we treat wallet software, CI/CD pipelines and open-source dependencies as part of our perimeter? We should.
8. If this happened to us, would customers hear from one clear, official channel? Silence and mixed messages are exactly what scammers feed on.

If you’re a Binance customer

The stolen money came out of Binance’s own hot wallets, and Binance has said it will cover the losses. Honestly, the bigger risk to you right now is the wave of scams that always follows a hack like this (2-Spyware).

For now, get your updates only from the official Binance app or a web address you already know, never from a link someone sends you. Assume any unexpected call, email, DM or text about the hack is a scam; real support will never ask for your password, 2FA code or seed phrase. Ignore anything offering “compensation”, “fund recovery” or a “safe wallet” for your money. And don’t rush. Withdrawals are coming back in phases and some networks may still be paused, so check the official status page rather than reacting to messages that try to hurry you.

Over the next week or so, switch to a hardware security key or passkey, and turn on the anti-phishing code and withdrawal address allow-list. Delete API keys you don’t use, remove withdrawal rights from the ones you keep, and lock them to your IP address. Have a look at your login history and active devices, and change your password if anything looks unfamiliar.

Longer term, don’t leave more on any exchange than you’re actively trading. For holdings you plan to keep, self-custody with a hardware wallet is worth learning, along with how to protect your recovery phrase properly. And spread your risk rather than keeping everything in one place.

None of this is financial or investment advice. It’s general security hygiene.

The takeaway

No firewall was broken here. A trusted device, and the access that came with it, was used exactly the way the system allowed. Whether you run an exchange, a bank or a distribution business, one question is worth asking this week: which laptop in my company could move the most money, and what’s stopping it?

Sources

A note on this article. I wrote this on 31 October and updated it on 2 November, using only what has been publicly reported. Binance is still investigating, so some details may change. Where I name the attackers, I’m relying on the FBI’s public statement and the work of blockchain analysts, not findings of my own. This is educational commentary, not legal, financial or investment advice, and I’m not suggesting Binance or anyone on its team did anything wrong. I have no affiliation with Binance, and Binance is a trademark of its owner.

Image Credit: QBS Technology Group