The $6.3 Billion Binance Hack

Lessons for every company

On October 29, 2026, at 20:05 UTC, money began flowing out of Binance’s hot wallets. Twenty minutes later, most of it was in the attackers’ hands. The final tally: about $6.3 billion, the largest cryptocurrency theft in history and possibly the largest heist of any kind.

We deliberately waited a few days. In the first hours after incidents like this, the internet is full of noise: theories change, numbers jump around, experts argue. Now we have an official FBI attribution, reports from blockchain analysts and the first findings of the investigation. That is enough to talk about causes rather than rumors.

The main takeaway is unpleasant. What happened to Binance can happen not only to a crypto exchange but to any company at all. Including yours. And then the conversation won’t be about a percentage of losses, but about all the money in your accounts, your customer databases, your source code and the reputation you spent years building.

What happened

The attackers drained about $6.3 billion from the hot wallets of Binance, the world’s largest crypto exchange, across 10 blockchains at once. That is roughly four times more than the previous record holder, the Bybit exchange, which lost $1.5 billion in February 2025.

Key facts about the incident:

• Long preparation. According to the nonprofit Security Alliance (SEAL), the hackers had access to the exchange’s systems about eight weeks before the theft. They didn’t break in; they lived there and prepared carefully.
• Swift action on D-Day. The hackers moved most of the money in the first 20 minutes of the attack. The defenders didn’t have an hour, or even a lunch break, to think it over.
• Old acquaintances. The FBI has officially named the culprit: the North Korean group TraderTraitor, the same one that robbed Bybit. Pyongyang denies everything and calls the accusations a political provocation.
• Who pays for it all. Binance is covering customer losses from its SAFU insurance fund and its own money. About $2.85 billion has been frozen with the help of stablecoin issuers and blockchain networks.

A heist in four acts

The hackers didn’t crack the blockchain or guess any keys. They went after people. Here is how it played out, according to Binance’s own report.

Act one, June. Reconnaissance. A Binance engineer was setting up an AI coding assistant and downloaded an infected software package. The security team spotted the malware and replaced the laptop. A happy ending, it seemed. But the attackers had already learned the most important thing: who at the company was in charge of the wallets.

Act two, September. The dream job. Another engineer was contacted by a “recruiter” with an interesting vacancy. An interview, a test assignment, a file with code: all perfectly routine. Except the file was malicious and slipped past the work computer’s defenses. The signature is familiar: North Korean groups have spent years setting up fake companies for “interviews” like this, and SEAL counted at least four such “firms” in 2026 alone.

Act three, October 20. Expansion. From the compromised computer, using the exchange’s internal AI tool, the hackers reached two more engineers and took their keys for deploying software. Think of it as getting a pass to the vault’s service entrance.

Act four, October 29. D-Day. The attackers installed their own program inside the wallet infrastructure and gained access to the service that signs transactions. From there, the system itself “legitimately” signed transfers to their addresses, bypassing the normal withdrawal process. Worse, a new Ethereum feature for delegating permissions let the transfers continue even after the exchange had halted withdrawals.

The bitterest part: according to Binance co-founder Yi He, the exchange’s security team detected and stopped 57 North Korea-linked attacks in 2026, including fake interviews, infected packages and social engineering. The defenses worked 57 times, but on the 58th the just one miss was enough for the hackers.

Bybit and Binance: same signature, four times the money

In March 2025, we took a detailed look at the Bybit hack. Back then, hackers infected the computer of a developer at Safe{Wallet}, a third-party service the exchange used to manage its cold wallet, and spoofed the signing screen. Bybit staff saw the correct transfer but signed a completely different one.

The key thing the two heists have in common: nobody cracked the cryptography or many of the other security tools. In both cases, the way in was a developer’s computer, and the target was the moment of signing, when the system decides that a transfer is legitimate.

The difference is telling, too. After Bybit, the industry paid closer attention to contractors and signing screens. The hackers responded by going deeper, to the company’s own staff, and by cutting out the person who had to be fooled. In 2025, they needed a signer who wouldn’t notice the switch. In 2026, the machine signed everything on its own.

Why this was possible

There is no final technical report yet, but Binance’s initial report is enough to identify the weak spots. Almost none of them are about the blockchain.

Organizational shortcomings

• The incident was closed, the threat was not. In June, the exchange found an infected laptop and replaced it. But an investigation has to answer not only “what was infected” but also “what did the attackers manage to learn”. They had learned whom to attack next.
• People with access to money are the main target, yet they were protected like everyone else. Fake job interviews have been a well-known trick for several years. Even so, an engineer close to critical systems opened a “test assignment” on a work computer.
• Too much trust on the inside. One infected computer reached colleagues, and through them, the signing system. Inside the perimeter, everything was treated as “one of ours”.
• The defenses don’t forgive a single miss. Intercepting 57 attacks is an excellent result. But a system where one miss costs $6.3 billion is built with no safety margin.

Technical shortcomings

• Production keys lived on laptops. Credentials for deploying software were stored on engineers’ computers. Whoever took over a laptop got a way into the inner sanctum.
• AI tools with broad permissions. An internal AI assistant helped the hackers move from one employee to others. The more permissions a tool has, the more valuable it is to an intruder.
• The signing system trusted any “internal” request. Binance stresses that no private keys were leaked. They weren’t needed: the keys stayed in the safe, and the hackers only needed whoever opens that safe.
• No brakes on huge amounts. Judging by how fast the money left, large transfers didn’t run into limits or manual approval. Billions were gone in less time than a typical meeting.
• Complexity makes it hard to stop. A new Ethereum feature allowed transfers to continue after withdrawals were halted, and the distributed signing scheme (MPC) made it harder to revoke permissions quickly. A protective mechanism that can’t be switched off in an emergency works against you in a crisis.

You’re not a crypto exchange? That won’t help you

You may not own a single bitcoin. But you almost certainly have everything the hackers needed in this story: employees who can be invited to an “interview”, computers with access to important systems, and something that “signs off” on money.

Your accountant and your online banking are your “signing service”. If an attacker is sitting in the accountant’s computer, the bank will execute the payment as perfectly legitimate. Reversing it afterwards is almost impossible.

A developer with cloud access is your “wallet”. At any SaaS company, online store or development studio, engineers’ laptops hold the keys to servers, customer databases and payment systems.

Fake job offers hit everyone. Today it’s a “test assignment” for a programmer, tomorrow a “résumé” for HR or an “invoice” for accounting. The mechanics are the same: a person opens the file themselves.

Almost everyone already uses AI assistants. Employees connect them to email, documents and code. Every such tool is another door the security team may not know about.

Money isn’t the only thing you can lose. A hacker who lives in your network for weeks can walk off with your source code, customer database and correspondence, then encrypt whatever is left on the way out. Binance was able to cover $6.3 billion from its own reserves. Most companies wouldn’t survive losing even a month’s revenue, let alone all the money in their accounts.

What changed in a year: six trends

Compare Bybit and Binance, and you can see where attacks are heading. Almost every trend matters to ordinary businesses as much as to crypto exchanges.

From contractors to your own people. Bybit was attacked through a supplier, Binance through its own engineers. The fake job interview has become a standard tool: cheap, scalable and almost invisible.

AI is a new door into the company. The first breach began with an infected package installed while setting up an AI assistant, and an internal AI tool became the bridge between employees. A year ago this was talked about as theory; now it’s a line in the report on the heist of the century.

AI has sped up vulnerability hunting for defenders and hackers alike. In October, researchers using AI found two critical vulnerabilities in PHP that had been hiding for more than ten years. PHP runs about 70% of websites, including WordPress, and attackers started exploiting the discovery almost immediately. The window between “found” and “under attack” has shrunk to days.

Patience plus speed. Weeks of quiet preparation inside the network, then twenty minutes for the theft itself. According to SEAL, other major heists this year, Bitget among them, followed the same multi-stage pattern. Defenses that react within hours are already too late.

New features, new risks. A convenient new Ethereum feature helped the hackers keep transferring funds after withdrawals were halted. The same goes for any new cloud or platform capability: it gets switched on for convenience, and abuse is considered later.

The good news: freezing works. Little of Bybit’s money was saved. At Binance, almost half of the stolen funds are frozen: stablecoin issuers and blockchain networks have learned to act together and fast. Cooperation is a defense, too.

What we do for ourselves and our clients

We are also a company that could be attacked in exactly the same way: we have engineers, servers, access credentials and AI tools. So we start with ourselves and bring what has proven itself to our clients.

Hardening: closing unnecessary doors

• Server login by keys only, with automatic blocking of password-guessing attempts. Admin panels are reachable only from trusted addresses.
• We switch off everything that isn’t in use. For example, the control panel’s built-in web terminal is disabled on all our servers, and unused network protocols are explicitly turned off rather than “just not used”.
• The two-channel rule. Particularly risky infrastructure actions are carried out only after a manager confirms them through two independent communication channels. A “do it now” message from a single hacked messenger won’t trigger anything.
• A system snapshot before every change. If something goes wrong, we roll back in minutes instead of spending days restoring everything.
• The core work is done with traditional tools and checked with AI, not the other way around.

AI-powered threat intelligence

• Daily matching of software “ingredients” against new vulnerabilities. We export a list of every component our systems are built from, and AI checks it against new threats every day. The result is simple: “no new threats” or an alert with specifics on what to update and where.
• AI sorts the flood of advisories. Vendors publish dozens of warnings a week. AI helps separate what calls for an urgent staff alert from routine updates, so people don’t get used to false alarms.
• Claude Mythos. We passed Anthropic’s vetting under its program for cybersecurity professionals and received Defense-tier access to Claude Mythos, the company’s flagship model. It helps us analyze vulnerabilities and strengthen defenses. AI suggests candidates, our specialists verify every finding manually, and H-X is accountable for the results under the contract.

What we offer

Everything that broke at Binance can be tested in advance, before TraderTraitor or someone more modest does it for you.

• Penetration testing. We answer the key question of this story: what will a hacker get if one of your employees opens a “test assignment”? We test websites, applications, clouds, networks and the supply chain, optionally with social engineering and in a Red Team format. Every project is run by two or three independent teams competing for findings, like a bug bounty program.
• Hardening. We separate developer laptops from production systems, remove standing access, and bring servers, clouds and deployment pipelines into line with CIS Benchmarks and NIST. The goal: one compromised computer should never open the way to everything.
• Threat intelligence. We monitor the dark web, leaks, spoofed domains and new vulnerabilities in your software. AI filters out the noise, analysts provide concrete recommendations. A monthly subscription you can cancel at any time.
• Incident investigation. Who got in, when and how, and — the main lesson of June — what they managed to learn and carry off. We collect court-admissible evidence and prepare response procedures in advance, so you don’t have to improvise in a crisis.
• Social engineering simulation. We safely test whether your employees will open a fake job offer, “invoice” or “résumé”, and teach them to spot such traps.

Don’t wait for your own October 29

The most expensive date in this story is not October 29 but June. That’s when Binance noticed the first warning sign, replaced the laptop and moved on. The theft was still four months away.

Most companies have already had a “June” like that: a strange email, an unexplained login, an employee who opened the wrong file. The question is who checked that the attacker didn’t stay inside.

If you’re not sure of the answer, contact us. The first consultation is free, and a conversation about your defenses will cost less than any one of those twenty minutes that cost Binance $6.3 billion.