Attackers stole $6.3 billion from Binance after moving from a compromised employee laptop to systems that could authorize cryptocurrency withdrawals, Dark Reading reported on November 2. The exchange says it has replenished approximately 95% of the affected assets with its own funds, while the reported attack path raises questions for organizations whose trusted internal systems can approve high-value transactions.
The theft occurred the previous week, the report said. Citing Binance’s disclosures, Dark Reading described an attack that reached a hot wallet—a wallet connected to online systems—and drained billions of dollars in around 20 minutes. It also reported that the FBI attributed the attack to North Korea’s TraderTraitor group.
For cryptocurrency custodians, the immediate issue is whether a compromised employee device can become a route to funds. The same question applies to enterprises whose internal services can release payments, access customer databases or authorize software deployments, security specialists told Dark Reading.
From a developer’s laptop to withdrawal authority
Binance’s initial findings identified an employee laptop as the starting point. Its subsequent investigation found additional points of compromise, extending the incident beyond that device.
The attackers used the developer’s compromised laptop to access an internal service container, an environment running software with permission to initiate withdrawal requests. From there, they exploited additional points of compromise and an Ethereum account-delegation mechanism, which allows authority over an account to be assigned, to obtain transaction approval authority over a hot wallet.
The attackers appear to have bypassed Binance’s normal approval controls. Binance said it had found no evidence that leaked wallet keys were used in the theft. Those private keys authorize cryptocurrency transfers, but protecting them alone does not secure every system allowed to request their use.
Waseem Ahmed, head of engineering at Secure.com, told Dark Reading that the available information suggests the attackers used Binance’s own signing system to sign the transfers. That would explain how an unauthorized transfer could carry a valid cryptographic signature: the signing process could work while the decision to approve the transaction was wrong.
The precise sequence of unauthorized approvals and the safeguards in place remain unclear as Binance’s investigation continues. After the attack, the exchange moved to freeze roughly $3 billion. Its separate claim to have replenished approximately 95% of affected assets describes replacement with company funds, rather than recovery of the stolen cryptocurrency.
Independent controls around valuable assets
Tim Rawlins, senior adviser and director of security at NCC Group, said platforms holding digital assets need independent security layers so that compromising one component cannot authorize a transfer. He recommended separating funds between hot wallets and cold wallets, which keep keys offline, to limit how much a single compromise can expose.
Rawlins also recommended dedicated privileged-access workstations for developers and administrators performing critical operations, separate from devices used for email and web browsing. Continuous monitoring should help identify compromised endpoints and unusual activity before attackers exploit privileged access.
The review needs to cover components and privileged roles whose compromise could give someone control over funds, he said, including the systems that request and approve key use. Threat modelling—mapping plausible ways an attacker could reach a valuable asset—and testing the complete transaction process are part of that work.
John Bruggeman, virtual chief information security officer at IT services firm CBTS, said large exchanges must examine what trusted identities and systems are permitted to do, alongside perimeter defenses and authentication. His recommendations included private-key management, multifactor authentication for key use, transfer-size limits, alerts for large transfers, endpoint detection on every employee device and analysis of user behavior.
He also called for withdrawal rate limits, controls protecting wallets and cryptocurrency custody, and segregation of duties: one user should not be able to both initiate and finalize a transfer.
Ahmed recommended human approval before actions that move money or data, with limits enforced across systems collectively. Security teams should test the complete route from an employee laptop to a payout, he said. For example, replacing the withdrawal service with a corporate payment system creates a similar question: can a compromised device reach a service trusted to release money?
A wider pattern of cryptocurrency theft
Dark Reading described the Binance theft as the largest cryptocurrency-exchange breach by value. Exchanges face many threats familiar to banks, but the report noted that they have not faced the same level of operational-risk and security oversight.
Earlier incidents illustrate several routes to funds: Bybit lost approximately $1.5 billion in February 2025 after attackers manipulated an Ethereum cold-wallet approval process; Binance lost 7,000 bitcoin in May 2019 after attackers obtained user API keys and two-factor authentication codes; and attackers compromised a third-party script on Polymarket’s website in October 2026 to move funds from some user wallets.
Dark Reading reported that North Korean actors accounted for 76% of the money traders had reported stolen so far in 2026, and at least one-third of reported cryptocurrency theft in six of the past nine years.
Robert Coles, senior manager of threat intelligence security at Black Duck, said organizations should assess how much damage an attacker can cause after gaining initial access. For security teams reviewing the Binance attack, the practical task is to identify critical systems and privileged accounts, then test which independent controls would stop a compromised device from reaching them and executing a high-impact action.
