Binance’s 6.3 billion theft started with one laptop: securing your admin workstation
On October 29, 2026, at about 4:05 p.m. Eastern, attackers began draining wallets at Binance, the world’s largest cryptocurrency exchange. Within about twenty minutes, most of roughly 6.3 billion US dollars had left the platform. It is the largest cryptocurrency theft on record, about four times the Bybit theft of February 2025.
The starting point, according to Binance’s preliminary investigation: a DevOps engineer’s compromised laptop. You don’t handle crypto? The lesson still applies, because every SMB has at least one admin workstation: the computer of whoever manages Microsoft 365, the servers, payroll or wire transfers.
What Binance said, and what is still unconfirmed
Binance says the access gained from that laptop let the attackers reach a service container and then submit unauthorized withdrawals. The company says it has found no evidence so far that wallet private keys leaked. Co-CEO Richard Teng said “the attacker did not simply use one engineer’s permissions, and this was not a single ‘one-click’ action. It involved a more complex attack process.” Binance adds that it has uncovered additional points of breach and does not blame any individual.
✔️ What is known (October 30)
- A compromised DevOps laptop was the entry point, according to Binance.
- The unauthorized withdrawals were submitted from a service container.
- Deposits and withdrawals were suspended and authorizations revoked.
- Binance says it will cover losses from its SAFU fund and its own funds.
- TRM Labs and Chainalysis attribute the theft to TraderTraitor, a North Korea-linked group.
❓ What is still unclear
- How the laptop was compromised in the first place.
- What the “additional points of breach” are.
- How much will eventually be recovered.
- Binance has not made an official attribution.
How it unfolded
According to TRM Labs, quoted by CNBC, wallets were funded through Tornado Cash and transaction signatures were obtained in advance.
Funds move across about ten blockchains (20:05 UTC).
Most of the roughly 6.3 billion has already left Binance.
Tether, Circle, Ripple, World Liberty Financial and Arbitrum freeze part of the funds, about 2.7 billion according to TRM Labs.
About 2.4 billion in ETH and BTC that no issuer can freeze.
One detail matters for an SMB: it all played out in about twenty minutes, after at least a day and a half of quiet preparation. As TRM Labs’ Ari Redbord put it: “A freeze stops the money from moving, and recovery follows through legal process.” What leaves fast comes back slowly, if at all.
Why the admin workstation is the real target
Attackers don’t go after the best-protected servers first. They go after the person who has access to them, and the computer where that person is already signed in. That machine holds open sessions, tokens, cloud access and sometimes secrets. Here is how the blast radius grows, at Binance and at your company:
From the laptop to the money: the circles to protect
1. The administrator’s laptop
Email, browser, developer tools and admin access on the same machine.
2. Sessions and tokens already open
Cloud console, Microsoft 365, password manager: no password needed if the session is stolen.
3. Internal systems
At Binance, a service container. At an SMB: the file server, the accounting software, the backup console.
4. Whatever moves money
Withdrawals at Binance. At your company: wire transfers, payroll, a supplier’s changed banking details.
Every circle crossed without a fresh check widens the damage.
Binance and your SMB: same problem, different scale
| At Binance | The SMB equivalent | The fix |
|---|---|---|
| A DevOps engineer’s laptop compromised | The laptop of whoever manages Microsoft 365 or the servers | A dedicated admin workstation, with no email or personal browsing |
| Access to a service container | Standing access to servers and the cloud console | Separate admin accounts, access granted only when needed |
| Withdrawals submitted automatically | A wire or payroll change made from a legitimate account | Two people for any money movement, confirmed through another channel |
| Everything gone in 20 minutes | Fraud discovered the next day | Real-time alerts and the ability to cut access immediately |
Securing your admin workstation in 6 steps
Checklist for this week
- ☐ Reserve a computer (or a separate session) for admin tasks: no email, no open browsing, no personal software.
- ☐ Create admin accounts separate from everyday accounts, with phishing-resistant multifactor authentication (security key or passkey).
- ☐ Remove standing admin rights: grant them for a task, then take them back.
- ☐ Require two people for wires, payroll and banking-detail changes, with a callback to a known number.
- ☐ Run an EDR such as SentinelOne on admin workstations and revoke sessions as soon as a machine looks compromised.
- ☐ Keep secrets (API keys, service passwords) in a vault, never in files on the laptop.
Session theft is one of the most common ways around a password: we explain it in our article on Microsoft 365 session token theft. And North Korea-linked groups don’t only target crypto platforms: they also use fake remote IT workers to get inside ordinary companies.
How NeoTech can help
Our server management service separates admin access and removes unneeded rights, our cybersecurity services review payment approvals and authentication on your sensitive accounts, and our automated 24/7 monitoring with on-call technician intervention flags unusual sign-ins and suspicious behaviour on monitored computers.
Book your free cyber check
In 30 minutes, we look together at who holds admin rights at your company, on which computers, and what would stop a compromised laptop from reaching your money.
Call us at 438-476-2322 or email info@neotechcloudsolutions.com.
Our office: 2572 boul. Daniel-Johnson, office 237, Laval.
Sources
- BleepingComputer, Sergiu Gatlan, “Binance links $6.3 billion crypto theft to compromised DevOps laptop” (October 30, 2026)
- CNBC, Jenny Lee, “Binance’s $6.3 billion hack: What we know and what comes next” (October 29, 2026)
- CNBC, “Biggest-ever crypto hack impacts $6.3 billion from Binance” (October 29, 2026)
Photo: VAZHNIK, Pexels (Pexels licence).