What happened
On October 29, hackers stole about $6.3 billion in crypto from Binance, the world's largest crypto exchange. It's the biggest crypto theft on record. Investigators traced the money out of Binance wallets on ten blockchains, and most of it was gone in about 20 minutes. (CNBC, NPR)
Who did it
TRM Labs and Chainalysis, two firms that track crypto crime, both say a North Korean government hacking group called TraderTraitor did it. The group has hit crypto companies before. (CNBC)
How one laptop became the way in
Binance says it looks like the attackers came in through an engineer's laptop, got into internal systems from there, and sent withdrawals nobody at the company approved. They took their time, too. According to Binance, the attackers had things set up well before the theft, collected the approvals they needed ahead of time, and then used them all at once. The investigation is still early, and Binance has promised a full technical write-up. (CNN, CNBC)
What this looks like in a typical company
We see this a lot. Someone's computer gets compromised, the attacker sits quiet for a while, and when they finally move, it's over fast. In a normal business, that laptop might belong to someone in accounting with access to the banking portal, or an IT person with admin rights to everything. The attacker doesn't need to break into each system one by one. They just use the access that person already has.
A few questions to ask at your own company
- If one employee's laptop got taken over today, what could the attacker get to?
- Can one person approve a big payment or transfer without anyone else signing off?
- Would anyone notice an outsider poking around your network for a few weeks?
The takeaway
Don't treat this as a story about one engineer making a mistake. Laptops get compromised. What matters is how far an attacker can get once they're on one. At Binance, a single machine led to systems that could move billions, and the attackers had time to prepare without anyone noticing.
Start by mapping what each employee's device can reach, especially anything that touches money, customer data, or admin access. Require a second approval for anything big. Watch for quiet activity, not just obvious alarms. If you'd like someone to walk that path through your systems before an attacker does, that's what our assessments are for.