Binance spends more on security than most companies earn. It still lost about $6.3 billion on 29 October 2026, and its own preliminary explanation was strikingly ordinary: a DevOps engineer's laptop was compromised, and from there the attackers reached the systems that authorise withdrawals.
That is the useful part of the Binance hack for anyone running a business. Your company is not holding billions in a hot wallet. But it almost certainly has one or two people whose laptops can move money, change DNS, approve payments or reach customer data. Attackers know that, and the North Korean groups blamed for Binance have made a business out of it.
The short version
- The weak point is rarely the software. It is one trusted person's device with too much access.
- Attackers get onto that device with fake job offers, fake tools and impostor suppliers, not movie-style hacking.
- Seven controls would have made the Binance attack much harder: separate devices for privileged work, approval by more than one person, short-lived access, limits on what any one key can move, fast alerts, a rehearsed shutdown, and a reserve fund.
- A 10 to 50 person business can put most of them in place in a month, for less than the cost of one bad wire transfer.
How did one laptop lead to a $6.3 billion loss?
The technical report is not out yet, so here is what has been said publicly, as of 1 November 2026:
- An engineer's laptop was compromised. Binance later found "additional points of breach".
- Binance says no wallet private key leaked. Instead, its co-CEO said the attackers abused EIP-7702, an Ethereum feature that lets a wallet delegate authority to code, and earlier reports pointed to malicious wallet authorisations.
- Outside analysts suggested one signature may have granted a full-access token that never expired.
- Analysts think the attack was prepared for at least 36 hours, then executed across ten blockchains in about twenty minutes.
Read that list again without the crypto words: a trusted device, a standing permission that was too broad and too long-lived, and nobody able to stop it quickly. That pattern describes most business compromises we see, from fake supplier invoices to hijacked company email.
How do attackers get onto a trusted laptop?
North Korean groups are the most documented, but the methods are copied by ordinary criminals:
- The fake recruiter. A developer is offered a well-paid job and asked to run a "take-home test" that installs malware.
- The fake tool. A browser extension, a code package or a cracked app that does what it says and something else besides.
- The impostor hire. A remote contractor using a false identity, given access on day one.
- The supplier. In the 2025 Bybit theft the attackers compromised a developer at a wallet supplier rather than at Bybit itself.
- The personal laptop. Work done on a machine also used for gaming, downloads and family browsing.
Seven controls that would have made it harder
1. Privileged work happens on a separate, locked-down device
The people who can move money or change production systems do that work on a device used for nothing else: no personal email, no browsing, no installs without approval. It is the single most effective control on this list, and the cheapest in proportion to the risk.
2. No single person can move serious money
Payments, wallet changes, DNS changes and admin role grants above a set threshold need a second person to approve on their own device. In a bank this is called four-eyes; in crypto, multi-signature. If one laptop is compromised, the attacker still needs a second.
3. Access expires
Standing, never-expiring permissions are what turned one laptop into a $6.3 billion event. Grant admin access for a task and let it lapse. Rotate API keys and tokens on a schedule. Review who has what every quarter.
4. Limits on what any one key can do
Hot wallets exist because withdrawals need to be fast, but nothing requires one wallet to be able to empty billions in minutes. The business version is transfer limits on bank accounts, spending caps on company cards and rate limits on systems that export customer data.
5. Alerts that a human sees in minutes
Tether froze attacker wallets 56 minutes after the first transfer; Binance removed the attackers' permissions about four hours in. Unusual volume, new payees, logins from new countries and admin changes out of hours should page someone, not sit in a log.
6. A shutdown plan you have rehearsed
Binance could halt withdrawals across a global exchange. Can you freeze payments, revoke all sessions and lock admin accounts in ten minutes at 1 a.m.? Write down who does what, and practise it twice a year. Our business continuity plan guide covers the template.
7. A reserve for the bad day
Binance survived because of its SAFU fund and a very large balance sheet. Most businesses will not have that, but they can hold cyber insurance and a cash reserve sized to the worst plausible incident, and know in advance who decides to use it. We explain the reserve maths in the 13-week cash flow forecast.
A one-month plan for a small business
| Week | Do this |
|---|---|
| 1 | List everyone who can move money, change DNS or domains, or grant admin access. Remove anyone who no longer needs it. |
| 2 | Turn on two-person approval for payments above a threshold. Move privileged work to dedicated, managed devices. |
| 3 | Set alerts for new payees, admin changes and logins from new locations. Rotate passwords, API keys and tokens. |
| 4 | Write the one-page shutdown plan and rehearse it. Check that hiring includes identity verification for remote staff. |
If you employ remote developers or virtual assistants, our corporate device security policy for distributed teams gives you the written policy to hand them. For payment-specific fraud, see deepfake payment fraud controls.
Frequently asked questions
How did hackers get into Binance?
Binance's preliminary finding is that a DevOps engineer's laptop was compromised, followed by other points of breach. The attackers then abused hot wallet authorisations. A full report is pending.
Could this happen to a small business?
Yes, at a smaller scale. Most business compromises start with one person's device or email account that can approve payments or access systems.
What is the most important security control?
Making sure no single person or device can move serious money or grant admin rights alone. Two-person approval stops most single-device compromises.
Do small businesses need cyber insurance?
If a single incident could wipe out several months of profit, insurance plus a cash reserve is usually worth pricing.
Sources
CBS News for the compromised laptop, additional breach points and outside analysis; CoinDesk for the DevOps engineer detail; Wikipedia: 2026 Binance hack for EIP-7702, the 36-hour preparation and the timeline. As of 1 November 2026.
