What happened. On October 29, an attacker moved about $6.36 billion out of Binance wallets on ten blockchains, most of it in roughly 20 minutes starting at 4:05 PM ET, according to blockchain analytics firm TRM. That’s about four times the $1.5 billion Bybit theft of February 2025, and the largest crypto theft on record. TRM and Chainalysis both attribute it with high confidence to TraderTraitor, the North Korean state-backed unit also tracked as Lazarus Group and APT38. Binance says it will cover all losses and has set aside more than $6.34 billion.
How Binance says they got in. A DevOps engineer’s laptop was compromised. From there the attacker reached a service container, a small packaged piece of production software, and used it to submit withdrawal transactions. Binance says it has found no evidence that a wallet private key leaked. Co-CEO Richard Teng added that the attacker “did not simply use one engineer’s permissions,” that it wasn’t a one-click action, and Binance has since “uncovered additional points of breach.” So the story will change. But the shape is already clear.
The key didn’t need to leak. This is the part every security team should sit with. Exchanges spend fortunes keeping private keys inside hardware security modules and split-key systems so nobody can steal them. The attacker didn’t steal one. It got close enough to a system that was allowed to ask for signatures, and the signer said yes. On Ethereum, TRM says the attacker used EIP-7702, a newer feature that lets a normal wallet run smart-contract code, to turn a Binance hot wallet into a sweeper it controlled, with 50 authorizations prepared in advance. On the other nine chains, Binance wallets sent funds through ordinary signed transfers. TRM reads that as a compromise of the hot-wallet signing setup. You don’t need the key if you can borrow the hand that holds it.
This isn’t a crypto problem. Swap the words. “Engineer laptop reaches a production container that can sign things” describes most software companies. Your CI/CD runners sign builds. Your deploy containers push to production. Your cloud automation holds credentials that can delete backups. Bybit started the same way: North Korean hackers compromised one developer’s computer at wallet provider Safe and planted code in its infrastructure. Two of the biggest thefts in history began on a developer machine. Developers are the new privileged users, and most companies still treat their laptops like everyone else’s.
Speed is the other lesson. Twenty minutes. No human-led response wins that race. Stablecoin issuers including Tether, Circle and Ripple froze about $2.67 billion, and Arbitrum’s security council froze more, roughly $2.7 billion in total. The attacker raced the freezes and still holds about $2.4 billion beyond any issuer’s reach, per TRM. Recovery helped because some assets have an issuer with a kill switch. Your production data has no Tether to call.
What to do Monday. Five moves, in plain terms.
One: any laptop that can reach production is a privileged workstation. Separate device or hardened profile, phishing-resistant login, no personal browsing, tight monitoring.
Two: no standing access from laptops into service containers. Grant it just in time, for one task, and let it expire.
Three: put rules at the signer, not just around the key. Limits on amount, new destinations and new transaction types. If a signer can’t explain what it’s signing, it shouldn’t sign. Crystal Intelligence’s read is that Binance’s signing path either signed blindly or didn’t recognize the EIP-7702 authorizations as moving money.
Four: new platform features are new attack surface. EIP-7702 is to wallets what a new cloud permission type is to your AWS account. Review it before attackers do.
Five: automate the brakes. Velocity caps and auto-pause on unusual outflows, whether that’s money, data or deletions. A human approval that takes an hour is decoration against a 20-minute attack.
Where I land. The industry sells “keys that never leave the vault.” Binance shows that’s necessary and not enough. The control that matters is what the vault agrees to do, and who can ask. Expect budgets to shift from protecting secrets toward governing the machines and people allowed to use them.