On the evening of October 29, attackers drained funds from Binance hot wallets across at least ten blockchains.
Within hours, an estimated $6.3 billion in crypto assets had been moved. That’s more than four times the roughly $1.5 billion stolen from Bybit in 2025, the previous record.
Binance, the world’s largest crypto exchange, paused deposits and withdrawals, said user funds were safe, and pledged to cover all losses. Crypto prices fell sharply.
And everyone started asking the same question: how do you take $6 billion from a company that big?
According to Binance’s initial investigation, the incident may have begun with a compromised DevOps engineer’s laptop.
Let’s break down what we know so far.
What you can expect from this article:
What happened, in plain English
What a “hot wallet” is, and why it’s the weak spot
Why some of the stolen money was frozen and some wasn’t
What it means for you, and the lesson every company should take from it
What happened
Binance is a crypto exchange. Think of it as a bank for cryptocurrency: millions of people keep their money there and trade through it.
On October 29, funds started moving out of Binance’s hot wallets. According to blockchain analysis firm TRM Labs, the first transfers happened around 20:05 UTC. Wallets on other blockchains followed within minutes, and a second wave of withdrawals occurred shortly after 23:00 UTC.
Binance confirmed a “security incident” and estimated the total impact at about $6.3 billion.
How did they get in?
Binance hasn’t published the full technical details yet. It has promised a detailed post-mortem once the investigation is complete.
Its initial findings suggest the attacker compromised a DevOps engineer’s laptop and used it to reach an internal service used to submit withdrawals. Binance has also said the attack was more complex than one person’s permissions being misused, so expect more details.
What’s interesting is what didn’t happen. There’s no sign the attackers broke the cryptography or found a flaw in the blockchain itself. According to the early findings, they got access to systems that were allowed to move money, and used it.
The weak spot: hot wallets
To understand why this matters, you need to know the difference between two kinds of crypto wallets:
Hot wallet: connected to the internet. It’s used for everyday withdrawals, so it has to be fast and always available. Think of it as the cash register in a shop.
Cold wallet: kept offline. It’s slow to use, but very hard to reach. Think of it as the bank vault.
Exchanges keep most of their money in cold storage, and only what they need for daily operations in hot wallets.
So why are hot wallets the weak spot? Because they’re built to send money quickly, without a human checking every withdrawal. Internal systems at the exchange are allowed to send transactions from them automatically.
And that’s what the attackers seem to have used. They didn’t steal the key to the cash register. Binance says there’s no evidence a private key leaked.
Instead, according to the early findings, they got behind the counter: into the internal system that submits withdrawals. From there, they used the register the way an employee would.
That’s why nothing had to be “broken.” To the blockchain, the transfers looked completely legitimate.
Who did it?
Binance hasn’t attributed the attack to anyone.
Blockchain analysis firm TRM Labs attributes it, with high confidence, to TraderTraitor, a North Korean hacking unit linked to the Lazarus Group. The FBI previously connected the same group to the Bybit hack.
This hasn’t been officially confirmed. According to TRM, the attack showed signs of preparation, including funding and test runs before the main theft.
What does it mean for you?
If you use Binance:
Binance says user funds are safe and that it will cover losses. Follow only its official channels for updates.
Watch out for scams. Big news brings fake “Binance security” emails and messages asking you to “verify your account.”
Don’t move funds because of a DM, an email or a “support agent.” Binance suspended deposits and withdrawals, so any unexpected request to “transfer your funds to safety” is a major red flag. Never click links in messages like that. Open the app or website yourself.
If you work in IT or security:
This is the real lesson. If the initial findings hold, look at the chain:
One person’s device was compromised
That device led to systems that could move money
Once the attacker was inside, the transactions looked legitimate
Replace “crypto exchange” with any company. Your most powerful access often sits on someone’s laptop: an admin, an engineer, a finance manager.
And as always, let me remind you of the fundamentals that help stop attacks like this:
Least privilege: nobody should have more access than their job requires
Separation of duties: no single person or device should be able to move large amounts of money alone
Protected admin devices: the devices used for the most critical tasks shouldn’t be the same ones used to read email and browse the web
Monitoring: unusual activity should trigger an alert before it becomes a multi-billion-dollar problem
Would you spot the weak point?
Least privilege, separation of duties, protecting privileged access and monitoring aren’t just lessons from the news. They’re exactly what the CC and CISSP exams test.
Take the free CC Readiness Test and see how you’d do on questions like this:
This story is still developing. Details may change once Binance publishes its full post-mortem.
Stay tuned!
Erich
Let’s Connect
If you want to collaborate, discuss, or just geek out over networking and cybersecurity, reach out:
Email: erich.winkler@decodedsecurity.com
LinkedIn: Erich Winkler
Gumroad community: Decoded Security
Start Here: Decoded Security Roadmap
Enjoyed this article? Like it or drop a comment. I’d love to hear your thoughts and questions!
Let’s learn and grow together!