The $6.3 Billion Binance Hack, Explained Simply
On the afternoon of October 29, 2026, attackers moved about $6.3 billion out of Binance, the world's biggest crypto exchange, in roughly 20 minutes. It's the largest crypto theft on record, and by some estimates the largest theft of any kind.
You don't need to understand crypto to understand what went wrong. Strip away the blockchain jargon and this is a story every company should recognize: someone got hold of a trusted employee's computer, and the systems behind it did what that computer told them to.
Investigators are still working, and some details will change. Here's what has been reported so far, in plain English.
What happened, in one paragraph
Binance says the attack began with a compromised laptop belonging to one of its engineers. From that laptop, the attackers reached an internal system (a "service container," basically one of the programs that runs Binance behind the scenes) that could send withdrawal requests. They used it to send out a flood of unauthorized withdrawals from Binance's "hot wallets," the accounts the exchange keeps online so customers can withdraw quickly. Blockchain analysts at TRM Labs say the withdrawals were approved ahead of time and then fired off in one burst. Binance froze deposits and withdrawals, and the FBI has since said North Korea was behind it.
The bank-vault version
Imagine a bank where the vault can't be cracked. The walls are thick and the lock is perfect. But the vault opens for anyone carrying a staff badge who's standing at the right terminal.
The thieves didn't attack the vault. They got hold of a trusted employee's badge and terminal, quietly filled out a stack of withdrawal slips, got them signed, and then cashed them all in a few minutes before anyone could react.
That's roughly what happened here, step by step:
- Get in through a person. The attackers compromised one engineer's laptop. How hasn't been made public yet.
- Use that person's access. From the laptop they reached an internal system that was allowed to request withdrawals.
- Prepare quietly. TRM Labs says the preparation started at least 36 hours earlier, and the withdrawals were signed in advance.
- Move fast. Everything went out across about 10 blockchains in roughly 20 minutes, faster than people could step in.
Binance's co-CEO Richard Teng has since said it was more complicated than one engineer's permissions being misused. That's worth keeping in mind. But the first door, by Binance's own account, was a single person's computer.
Where the money went
Some of it came back, or at least stopped moving. About $3 billion has been frozen. That was possible mostly because some of the stolen money was in "stablecoins," crypto dollars issued by companies like Tether and Circle, who can freeze their coins much like a bank can freeze an account. Both froze wallets within about an hour.
Bitcoin and Ether don't have an issuer who can do that. Once those are gone, they're much harder to get back.
For Binance's customers, the news is better than it could have been. Binance has said "Binance will absorb the financial impact of these stolen funds, not our users," and it paid for that with its emergency insurance fund (called SAFU) and its own reserves. On November 1 it began reopening withdrawals, starting with Bitcoin.
Who did it
The FBI says North Korea. Blockchain investigators at TRM Labs and Chainalysis point to a North Korean state-backed group known as TraderTraitor. The FBI previously tied the same group to the $1.5 billion theft from the exchange Bybit in February 2025.
For more on the group and its playbook, see Meet TraderTraitor.
This matters for everyone else because groups like this run the same playbook again and again: they go after the people with access, not the strongest part of the system.
The lesson: a trusted computer isn't a trusted person
Every security system has to answer one question over and over: should I do what this request says?
Most systems answer it by checking something the request carries: a password that was typed earlier, a login session, an approved device, a signature. If the request carries the right thing, it goes through.
The problem is that all of those can be carried by someone else. Once an attacker controls a trusted computer, or copies what's on it, every request looks exactly like it came from the real employee. The system has no way of asking the question that actually matters: is the real person there, right now, and do they mean to do this?
Binance isn't unusual here. The CircleCI breach started the same way, with malware on one engineer's laptop, and the attacker never needed to pass MFA again. The difference is the size of the prize. When one person's access can move billions, one person's laptop is a billion-dollar target.
What any company can take from this
You don't have to run a crypto exchange for this to apply. Swap "withdrawals" for "payroll changes," "wire transfers," "production deploys" or "customer data exports," and the same five steps hold:
- Treat employee laptops as the front door. Assume one will be compromised eventually. Use behavior-based endpoint protection, not just antivirus.
- Don't let one person's access do something huge. Anything that can move a lot of money or data should need more than one person, and more than one device.
- Make approvals expire fast. Approvals that are signed in advance and stay valid for a long time are a gift to an attacker who's willing to wait. Short-lived approvals shrink that window.
- Watch for bursts. Twenty minutes was enough here. Automatic limits on how much can leave in a short time buy people time to react.
- Check for the person, not just the device. Make sensitive access depend on proof that the actual employee is physically present, so a stolen laptop or a copied login isn't enough by itself.
Where NearAuth.ai fits, and where it doesn't
That last step is what NearAuth.ai is built for. It checks that your registered phone is next to your registered computer, using an encrypted Bluetooth handshake signed with keys that stay on the devices. It keeps checking during the day, not just at login. An attacker controlling a laptop from somewhere else doesn't have your phone in their pocket, and a session copied to another machine doesn't bring the phone along.
To be straight about the limits: we don't yet know exactly how the Binance attackers got into that laptop or what they took from it. NearAuth.ai protects sign-ins and the apps behind them. It isn't a crypto wallet or a transaction-signing system. No single product would have made this attack impossible on its own. What presence checks do is take away the attacker's favorite shortcut: borrowing a trusted person's access without the trusted person.
The biggest heists used to require breaking into the vault. Now they start with someone's laptop. Security has to start asking whether the person is really there.
NearAuth.ai is free for teams of up to 12 people, and most teams protect their first five people in about 15 minutes with Google Workspace or Microsoft 365.
chris@nearauth.ai