TL;DR
On October 29, 2026, attackers moved about $6.3 billion out of Binance across 10 blockchains in roughly 20 minutes. Binance’s early finding points to one compromised DevOps engineer’s laptop that opened a path to an internal service container able to submit withdrawals. No wallet key was reported stolen. Every transaction was signed correctly. That is the part worth your attention, because the same path shape exists in most companies that have never tested for it.
Introduction
Verizon’s 2026 breach report found that 31% of breaches now start with vulnerability exploitation, up from 20% a year earlier. Binance did not start there. It started on a laptop, reminding us that the entry point and the damage can be far apart.
What actually happened
The outflows began at 20:05 UTC. Five Binance wallets sent 233 million XRP to a single address, and nine more chains followed within minutes. On Ethereum, the attacker used an EIP-7702 delegation to turn a hot wallet into a sweeper contract, which emptied 167,464 ETH and 1.615 billion USDT in under four minutes.
Stablecoin issuers froze close to $2.7 billion inside 40 minutes. Binance puts the frozen figure nearer $3 billion and says it will cover every loss from its SAFU reserve and company funds.
Two blockchain analysis firms attribute the theft to a North Korean group with high confidence. Binance has not confirmed that, and no government has either. Loss estimates vary from $5.9 billion to $6.36 billion because each firm prices the tokens at a different moment.
How a laptop becomes a $6.3 billion problem
Binance has confirmed the start and end of the chain. The middle is reconstructed from how this group is known to operate, so treat the first and third steps below as a pattern rather than confirmed fact.
The engineer gets targeted, not the exchange
This group does not attack the perimeter. It goes after the people who have keys to it.
Researchers have documented fake job interviews aimed at DevOps and fintech engineers, weaponized GitHub repositories carrying malicious Terraform lock files, and custom Terraform registries that run malware when a developer runs a normal build command. One documented case involved macOS backdoors that sat quiet for weeks and only started calling home after a developer opened a poisoned workspace in their code editor.
That tradecraft maps to familiar MITRE ATT&CK techniques: T1566 phishing, T1195 supply chain compromise, T1204 user execution, then T1552 for harvesting whatever credentials the machine holds.
The laptop becomes a doorway
A developer workstation is rarely the target. It is the shortest route to something better.
Binance says the compromised laptop gave the attacker access to an internal service container. That is the step most companies share with Binance, and it is usually invisible because an engineering device talking to production looks like an engineer doing their job.
Trusted access does the rest
Here is the detail that makes this incident different from a normal theft. The container could submit withdrawals, so the attacker did not need to break any cryptography.
Every request carried a valid signature. The approval path checked whether the signature was correct, not whether the decision behind it was. Correct math, wrong human.
Why none of the tools stopped it
The finding is not the attack. It is the row that says nothing.
This is the output shape of an authorized red teaming exercise against the Binance style attack path. Four steps attempted. Three seen. One silent. The silent row is the finding, and it gets a named owner and a fix, not a severity score.
Attempted is not compromised. Detected is not stopped. The only way to tell which one you have is to run the steps yourself, inside an agreed scope, and write down what your tooling actually saw.
Most security stacks are organized by system. The endpoint tool watches the laptop. The cloud tool watches the environment. The transaction system watches transactions.
Each one can report a clean bill of health while the path running through all of them stays wide open. Nobody owns the question that connects them.
Your scanners will tell you a service exists. They will not tell you that a developer laptop two hops away can reach it and ask it to move money. That gap is where continuous attack surface management stops and something more adversarial has to start.
Our own research with 14 security buyers found that 57% carried an active concern about governance and control over automated action. The worry is real. The Binance chain shows what happens when nothing sits between access and consequence.
The four questions most teams cannot answer today
During a live incident, four questions decide everything. Are we affected and exposed? Were we attacked? What do we do now? Has it worked?
Each answer needs evidence, a confidence level, and a timestamp. Record missing telemetry as unknown, never as safe, because an empty log is not a clean one.
Binance could answer the first two within hours because blockchains are public. Most companies cannot. They spend the first day of an incident assembling the evidence instead of acting on it.
What red teaming would have found
A scanner tests a system. Red teaming tests a route.
An authorized exercise against this chain would attempt four things in order: sign in with engineering access, request elevated permission, reach the internal service path, then attempt a harmless version of the sensitive action. You record what your tooling actually saw at each step.
Three steps might get detected. The one that produces nothing is the finding, and it goes to a named engineering owner with a specific fix attached, usually a missing log source. That beats a severity score nobody acts on.
Red teaming versus continuous penetration testing
People use these as synonyms, and they are not.
Continuous penetration testing confirms which weaknesses are genuinely exploitable, and retests them after a fix. It is normally scoped per system, which is exactly how a chain crossing four systems slips between two clean reports.
Red teaming asks whether someone can get from an entry point to something that matters. It is the only one of the two that would have connected a laptop to a withdrawal path. If you want to see the mechanics, we walk through how to simulate lateral movement step by step.
Where attack path thinking fits
Knowing what you own is step one. Knowing how those things connect is the step that finds incidents like this.
Attack path modeling ranks weaknesses by where they sit on a route to something valuable, instead of by a number that treats every system as equally important. A medium severity flaw on the road to the treasury beats a critical flaw on a test box every single time.
Four controls that break this chain
- Treat engineering endpoints as tier zero assets. Device posture checks, phishing-resistant MFA, and production credentials that expire in hours rather than months.
- Split signing paths by system and tier, so one foothold cannot reach everything behind it.
- Put human approval gates on consequential actions, with velocity limits measured across systems rather than one at a time.
- Alert when an engineering device authenticates to a production path outside a change window. That single rule would have lit up step two.
They answer three different questions.
Most teams buy one of these and assume it covers the other two. The Binance chain shows why that assumption is expensive. Knowing what you own is not the same as knowing an attacker can reach the money.
Binance needed the third question answered. Each piece of that chain could pass its own review while the path through all four stayed open.
Your weakest laptop should not be able to move your biggest asset
Nothing between that engineer’s device and 10 blockchains stopped to ask a person for confirmation. Secure.com AI Teammates sit above the stack you already own and put that confirmation back into the path.
- The Red Teammate runs scoped, scheduled, recorded exercises against your real approval paths, so you find the route before someone else does.
- The SOC Teammate correlates endpoint, identity, and cloud signals into one prioritized investigation instead of four separate alerts in four consoles.
- The Infrastructure Security Teammate tracks permission and identity drift across accounts, which is where quiet footholds live for weeks.
- Consequential actions pause at a human gate. Your team sets the rules. The teammates do the work.
- Every recommendation, approval, and action is recorded, so you can walk a board or an auditor through the whole night line by line.
