What happened at Binance? The $6.3bn hack explained — and what normal businesses can learn from it

The short version: on Thursday 29 October 2026, attackers drained roughly $6.36 billion (£4.9 billion) from Binance’s operational “hot wallets” in just 20 minutes — the largest single cyber theft in history. Nearly half of the stolen funds ($2.7bn to $3bn) were frozen within hours, and Binance has promised to cover customer balances in full. For everyday UK businesses, the biggest lesson isn’t about cryptocurrency at all: it’s that the attackers appear to have started by compromising an engineer’s laptop and abusing internal privileges.

What happened on 29 October 2026

At around 20:05 UTC on Thursday 29 October, automated withdrawals began emptying Binance’s hot wallets — the online wallets an exchange keeps connected to the internet to handle day-to-day customer withdrawals. Within a 20-minute window, funds were swept simultaneously across 10 to 11 different blockchains, including Ethereum, Bitcoin, Tron, Solana and the XRP Ledger, followed by a second wave hitting Avalanche and Polygon.

By the time Binance suspended deposits and withdrawals across its platform to stop the outflow, approximately $6.36 billion in digital assets had been moved to attacker-controlled addresses. To put that number in perspective, it is roughly four times larger than the 2025 Bybit breach ($1.5 billion) and ten times the size of the 2022 Ronin Network hack.

What we know so far about how they got in

When a breach of this size hits the news, people often assume the attackers discovered some impossibly clever mathematical flaw in encryption. Almost invariably, the reality is much more familiar.

Based on Binance’s initial disclosures and analysis from blockchain intelligence firms TRM Labs, Elliptic and Chainalysis, here is how the attack unfolded:

1. A compromised staff laptop: Preliminary investigations pointed to a compromised DevOps engineer’s laptop. Rather than breaking through Binance’s external firewalls head-on, the attackers targeted an individual with legitimate access to internal infrastructure.
2. Pivoting into internal services: From that foothold, the attackers infiltrated internal service containers that communicate with Binance’s withdrawal signing infrastructure. Binance later clarified that the intrusion was a deeply layered attack involving multiple internal breach points rather than a single isolated mistake.
3. Automated, pre-signed extraction: Instead of manually stealing small amounts and risking an early alarm, the attackers prepared automated scripts across a dozen networks at once. On Ethereum, they used advanced account-delegation features (EIP-7702 pre-signed authorisations) to turn Binance’s own hot wallets into automated “sweepers”, draining balances in seconds.
4. A “self-destruct” clean-up: Once the 20-minute extraction finished, the attackers triggered a self-destruct mechanism inside the compromised environment to wipe their tooling and slow down forensic investigators.

Who was behind it — and what happened to the money?

Three major blockchain intelligence firms — TRM Labs, Elliptic and Chainalysis — have independently attributed the attack with high confidence to TraderTraitor, an elite cyber-espionage unit under North Korea’s Lazarus Group. TraderTraitor specialises in targeting engineers and administrators with convincing social engineering — fake job interviews, trojanised software tools, or malicious code packages — to get a foothold on a developer’s machine.

What happened next was an unprecedented race between the hackers and the wider industry:

• Nearly $3 billion frozen: Unlike traditional cash, many digital “stablecoins” (tokens pegged to the US dollar) have a freeze switch built into their smart contracts. Tether, Circle, Ripple and network security councils such as Arbitrum coordinated within hours to blacklist the attackers’ wallets, freezing between $2.7 billion and $3 billion before it could be moved.
• What couldn’t be frozen: Knowing that dollar-pegged tokens would be frozen quickly, the attackers used decentralised exchanges and lending protocols (such as Aave) in real time to swap and borrow native assets like Bitcoin (over 18,270 BTC) and Ether (over 420,000 ETH), which have no central issuer able to freeze them.

Why this matters if your firm never touches crypto

If you run a law firm, an accountancy practice or an engineering consultancy in South Wales, you might reasonably think a cryptocurrency heist on the other side of the world has nothing to do with you.

Look past the cryptocurrency, though, and the pattern is identical to the breaches we deal with in UK professional firms:

• Attackers don’t “hack the cloud” — they log in: Microsoft’s data centres and Binance’s core servers are extraordinarily well defended. So attackers don’t waste time trying to batter down the front door. They compromise one person’s laptop or steal one person’s Microsoft 365 sign-in session, and walk in using their permissions.
• One account with too much access turns a hiccup into a crisis: If a staff member’s everyday email account also holds Global Administrator rights in Microsoft 365 — or has unrestricted access to every SharePoint folder and finance mailbox — a single phished password gives an attacker the keys to the whole firm.
• Speed matters: The Binance attackers moved $6.3 billion in 20 minutes because their scripts were automated. When criminals break into a business Microsoft 365 account today, they use automated scripts too: within minutes of signing in, they create hidden inbox forwarding rules, search for words like “invoice”, “completion” or “remittance”, and register their own multi-factor authentication device so they can stay in after you change your password.

Four practical checks for your own business

You don’t need a billion-pound security budget to stop this pattern in a 10-to-50 person office. You just need four sensible guardrails in place:

1. Separate admin accounts from everyday email: Nobody in your firm — including directors and IT staff — should read daily emails or browse the web while signed in as a Microsoft 365 Global Administrator. Admin accounts should be separate, unlicensed accounts used only when changing settings.
2. Require compliant devices (Conditional Access): Even if an attacker steals a password and an MFA code, Microsoft 365 Conditional Access can block the sign-in completely if it doesn’t come from a known, company-managed laptop, or if it comes from an unexpected country.
3. Move past SMS and simple push-approval MFA: Modern phishing links steal the “signed-in” session cookie straight from the browser. Phishing-resistant sign-ins (passkeys, Windows Hello for Business, or device-bound policies) stop stolen tokens working on an attacker’s machine.
4. Keep laptops locked down to Cyber Essentials standards: Removing local administrator rights from everyday staff laptops prevents a downloaded file or browser exploit from quietly installing remote-access tools in the background.

Want to know where your firm stands?

If you’d like a plain-English check of your firm’s security without any sales pressure or scare stories, start with our free 28-point Microsoft 365 security audit or pop your work email into our free public-record security snapshot. You can also call Ross and the team in Cardiff on 029 2240 4615 or email ross@alphabyte.it.