On October 29, 2026, attackers moved about $6.3 billion out of Binance wallets across ten blockchains. Most of it left in roughly 20 minutes. Four separate security functions were doing their jobs that night, and the money still went out the door.
TL;DR
Binance lost about $6.3 billion in a single burst, the largest crypto theft on record. The early finding points to a compromised engineer laptop that reached an internal service able to submit withdrawals, which means the transactions looked authorized at every checkpoint they passed.
The failure was not a missing tool. It was that nobody owned the whole path from a developer machine to a withdrawal, tested it, fixed it, and tested it again. A digital asset firm we worked with hit the same shape of attack, and one accountable operation closed the chain in two days.
What happened in 20 minutes
The theft itself was fast. The setup was not.
The short version of the attack chain
Binance said its first investigation pointed to a compromised DevOps engineer laptop. That access reached a service container that could submit withdrawal transactions.
About six hours later the company said it had uncovered additional points of breach, and that the full account was still forming.
Binance also said it found no evidence that a wallet private key leaked. The attacker did not need one.
Blockchain intelligence firms attributed the theft to TraderTraitor, a hacking unit tied to North Korea. The FBI accused the same group two days after the attack.
If you want the full path walked step by step, we covered how a compromised laptop reached a service that could move money in a separate piece. This one is about why so many teams were watching and none of them stopped it.
The theft was fast. The access behind it was built slowly, and every step looked authorized to the systems watching it.
Sources: Binance initial findings, TRM Labs, BleepingComputer, CNBC.
A technically authorized action is not a legitimate one
Nothing in that chain required breaking cryptography. The attacker reached a system that was already allowed to move money and asked it to do its job.
Every check passed. The source was a trusted container. The signatures were valid. The dashboard stayed green.
Monitoring tells you what a system did. It does not tell you whether that system should have been able to do it.
That is the whole problem in one sentence, and it is not a crypto problem. Swap the withdrawal service for a payment system, a customer database, or a deployment pipeline and you have the same gap wearing different clothes.
The gap sits between four things your team already does
For decades, security has been split into separate activities. Each one is staffed, budgeted, and measured on its own.
Four functions, four scopes
- Security tools raise alerts.
- A managed SOC investigates the alerts it receives.
- Pen testers look for weaknesses on a schedule, usually once or twice a year.
- Engineers take the findings and work them into a backlog.
Each function does its job well. None of them owns the path that runs through all four.
The four questions nobody answers
- Who is continuously testing whether a compromised developer identity can reach production systems that move money?
- Who confirms the security controls would actually catch that attempt?
- Who makes sure the weakness gets fixed instead of aging in a ticket queue?
- Who tests the same path again to prove the fix held?
A report lands. A ticket opens. A quarter passes. Nobody goes back to check.
Each team is staffed, budgeted and measured on its own scope. The attack path runs straight through the space between them.
What happens today: a report lands, a ticket opens, a quarter passes, and nobody goes back to check.
What one accountable operation would do differently
The alternative is not more analysts watching more screens. It is one operation that carries a weakness from discovery to proof.
Before the attack: attack your own defenses first
A Red Teammate, working inside an approved scope, tests whether compromised development access can be chained into sensitive production infrastructure. Not in theory. On the actual environment.
An Infrastructure Security Teammate adds the surrounding picture: misconfigurations, exposed workloads, network reach, and which assets the business cannot afford to lose.
Security specialists then take the resulting attack paths to the engineering team and work on isolation, privileges, access control, and the boundaries around transaction approval.
The output is not another penetration testing report. The operation stays on the hook until the finding is fixed and retested. If you have never watched an attacker move sideways through your own network, simulate lateral movement before an attacker does and see how far a single workstation gets.
During the attack: connect the evidence, then act
When something looks wrong, a SOC Teammate pulls telemetry from connected endpoint, cloud, identity, and security systems into one timeline instead of four consoles.
Working with experienced responders, the service can run containment steps that were approved in advance, such as isolating an endpoint, revoking credentials, or restricting a compromised workload.
Where the operation is integrated with customer controlled financial systems, emergency procedures can also restrict sensitive transactions, with a human approving the call.
AI Teammates carry the analysis and the repetitive work. People handle judgment, exceptions, and anything with real consequences attached.
After the attack: make the next one harder
The work does not stop when the incident ticket closes.
Specialists trace the root cause, confirm the weaknesses that let the attacker in, widen detection coverage, and retest to find out whether the original path still works.
What you get is a baseline that keeps getting harder, not a return to business as usual.
A digital asset firm faced the same chain
This is not a thought experiment. A digital asset firm we worked with went through a version of the same attack, at a smaller scale and in slower motion.
How the attacker got in and stayed
The firm’s deployment pipeline was compromised. The attacker planted a backdoor on a trusted production machine.
From there, the attacker moved through the environment, stole credentials, and ran unauthorized transactions on the firm’s exchange.
Nobody noticed for weeks.
What left them exposed
- Security signals sat in separate tools that did not talk to each other.
- Production servers were reachable from the internet.
- Storage buckets were public.
- Machines approved once were never checked again.
The first 24 hours
Secure.com was brought in while the incident was still live. Within hours the team had a working map of the environment: every asset, every identity, and how they connected.
The Infrastructure Security Teammate flagged the exposed servers and open buckets. The SOC Teammate pulled the scattered signals into a single timeline.
Instead of thousands of findings, the team got three cases worth acting on: exposed production infrastructure, lateral movement paths, and compromised identities.
Day one and day two
Every high impact change needed a named approver and left an audit trail.
Servers moved behind network controls. Buckets were locked down. Identities were rotated.
A breach that had gone unnoticed for weeks was closed in two days. The firm went live again on a hardened baseline with no open attack paths left to its most critical systems.
Same shape of attack as Binance: a trusted pipeline, a backdoor on a production machine, and transactions nobody had approved.
- Security signals split across tools that did not talk
- Production servers reachable from the internet
- Public storage buckets
- Machines approved once, never checked again
- Within hoursLive map of every asset, identity and connection
- Day oneThousands of findings cut to three cases worth acting on
- Day twoServers behind network controls, buckets locked, identities rotated
- OutcomeBack live with no open attack paths to critical systems
Every high impact change had a named approver and left an audit trail.
How Secure.com helps
Secure.com runs one managed security operation that attacks your defenses, hardens what it finds, and proves the fix held. Your team sets the scope and approves anything consequential.
- A Red Teammate tests whether a compromised laptop or identity can actually reach systems that move money or data.
- An Infrastructure Security Teammate maps exposed assets, misconfigurations, and the paths that connect them to what matters.
- A SOC Teammate joins endpoint, cloud, and identity signals into one case instead of four tool queues.
- Validated findings are carried through to remediation and retested, so you get proof rather than a PDF.
- Scope, permissions, approval gates, and a full audit trail stay visible, so you can always explain who decided what and why.