Gold bitcoin coins resting on a laptop keyboard with a trading chart on screen

What the Binance hack teaches every security leader

On the evening of 29 October, someone stole about $6.3bn from Binance, the biggest crypto exchange in the world. Blockchain analysts at TRM Labs say most of it was gone in roughly 20 minutes. Binance says it may have started with one engineer's work laptop.

Binance says customers won't lose out. It will cover every loss from an emergency fund it keeps for this purpose and from its own money. Partners have already frozen about $3bn of the stolen funds, and Binance says it has started getting some back.

Why this matters if you don't work in crypto

Forget the coins for a moment. This is a story about two things every organisation has.

The first is the people who keep the systems running, often called DevOps engineers. Their laptops usually hold the logins and tools that reach the live systems customers use. Binance said the incident "may involve a compromised DevOps engineer's laptop". If an attacker controls that laptop, they don't need to break in. They can use the access that's already there.

The second is the system that says "yes" to money moving. At Binance, that's the setup that approves withdrawals. In your business it might be payment approvals, software releases or admin tools. Binance co-chief executive Richard Teng has said this was more than one person's access being misused in a single step. TRM thinks the attacker got control of what Binance's approval system would sign off.

This isn't a new trick. A 2022 advisory from the FBI, the US cyber agency CISA and the US Treasury describes North Korean hackers sending DevOps and IT staff fake, well-paid job offers to get them to install malicious apps. TRM and Chainalysis both believe the same North Korean group is behind this attack.

A laptop screen showing lines of code in a dark room — Engineers' laptops often hold the keys to live systems. Image: Nemuel Sereti on Pexels (Pexels License).

Five things worth doing now

Treat engineers' laptops as part of your live systems. If a laptop can change your live systems, protect it just as well.
Give out powerful access only when it's needed. Access that switches on for a task and then expires leaves far less for an attacker to steal.
Don't let one system approve everything. Split approvals by size and by business area, so one compromise can't empty the lot.
Let machines hit the brakes. Nobody responds in 20 minutes, so set automatic limits that pause unusual activity until a person checks it.
Know who to call before you need them. Tether froze the attacker's main wallet 37 minutes after the biggest transfer, TRM says. Test how fast you can reach your bank, payment provider and cloud provider at 9pm.

The NCSC's guidance on secure system administration is a good, practical place to start on the first three.

Say less, say it often

Binance's first explanation changed within hours. Soon it was reporting more ways in than the one laptop. That's normal. Say early findings may change, update often, and use one official channel. Teng also warned users not to trust "unofficial links, messages, or requests for account information", because scammers move fast after a big breach.

In the UK, the FCA told the BBC it is talking to Binance, even though Binance isn't registered with it for crypto services here.

What we don't know yet

This story is still moving. Binance hasn't published its full findings yet. The link to North Korea comes from TRM Labs and Chainalysis, and nobody official has confirmed it. The numbers may change too.

What's already clear is simple. Your most valuable systems are probably reached through ordinary laptops and approval tools. It's worth checking how well they're protected before someone else does.