Unless you’ve been living under a rock for the last 15+ years, you can’t fail to have noticed the rise of the cryptocurrency markets. These markets have provided a huge amount of wealth for investors and speculators, but also have provided a very tempting target for attackers.
This post explains what the Binance attack was, and how it appears to have happened.
But first, we need to have a bit of an understanding of the technologies involved.
What is a cryptocurrency?
Cryptocurrency emerged from a desire to create a form of digital money that could operate independently of traditional banks and financial institutions, and whilst earlier attempts at digital currencies existed, the modern cryptocurrency movement began in 2008, when someone (we don’t know if this is an individual or group) using the pseudonym Satoshi Nakamoto published a paper entitled Bitcoin: A Peer-to-Peer Electronic Cash System.
This paper proposed a revolutionary concept: a digital currency that could be transferred directly between individuals without requiring a trusted financial intermediary.
Following this, in January 2009, the Bitcoin network was launched, introducing the technology now known as blockchain. This distributed ledger records transactions across a network of computers, using cryptography and consensus mechanisms to maintain the integrity of its records.
Bitcoin initially attracted interest from cryptography enthusiasts and individuals interested in financial independence. However, its popularity gradually expanded as investors, businesses and financial institutions began recognising the potential of digital assets.
The emergence of Ethereum in 2015 significantly expanded the possibilities of cryptocurrency.
Unlike Bitcoin, which primarily functions as a digital currency, Ethereum introduced programmable blockchain technology through smart contracts. These contracts enabled developers to create decentralised applications, financial services and digital tokens.
Throughout the following years, cryptocurrency has evolved from a relatively obscure technological experiment into a global financial industry worth trillions of dollars.
According to the website CoinMarketCap, there are (at the time of writing) over 65M different cryptocurrencies
Crypto Exchanges
Cryptocurrency exchanges emerged to facilitate the buying, selling and trading of digital assets and Companies such as Binance became major financial platforms, processing enormous volumes of transactions and managing substantial quantities of customer cryptocurrency.
However, this rapid growth not only attracted investors and speculators, it also attracted cybercriminals.
The combination of valuable digital assets, complex technologies, internet-connected infrastructure and irreversible transactions created an increasingly attractive environment for financially motivated attackers. The same technologies that made cryptocurrency revolutionary also introduced entirely new cybersecurity challenges.
The Binance heist
On 29th October 2026, cryptocurrency exchange Binance suffered one of the largest financial thefts in history. The attackers reportedly stole approximately $6.3 billion in cryptocurrency, exploiting weaknesses in the infrastructure used to authorise and execute transactions.
This incident is particularly significant for cybersecurity experts because it highlights a fundamental principle of cybersecurity: you do not necessarily need to break into the vault if you can compromise the systems responsible for opening it.
The attack raises important questions about the security of cryptocurrency exchanges, the management of privileged accounts, the risks associated with DevOps infrastructure, and the increasingly complex relationship between traditional IT security and blockchain technology.
For cybersecurity professionals, this is a case study in infrastructure compromise, privilege abuse and the exploitation of trusted systems. For those unfamiliar with the world of cryptocurrency, it provides an opportunity to understand how digital assets are stored, transferred and protected.
So what happened?
Binance is one of the world’s largest cryptocurrency exchanges, and provides a platform through which individuals and organisations can buy, sell and exchange digital currencies.
Attackers compromised Binance’s transaction-authorisation infrastructure and initiated unauthorised transfers from cryptocurrency wallets controlled by the exchange totalling aproximately $6.3 billion in digital assets across multiple blockchain networks.
According to Binance’s initial investigation, the attack may have involved a compromised laptop which potentially allowed attackers to access an internal service container and submit unauthorised withdrawal transactions.
Binance later confirmed that its investigation had uncovered additional points of compromise.
Importantly for those with Binance accounts, the exchange reported that it had found no evidence that wallet private keys had been leaked.
This distinction is very significant. The attackers may not have obtained the actual cryptographic keys used to protect the cryptocurrency. Instead, they appear to have compromised systems capable of authorising transactions.
The FBI subsequently attributed the theft to North Korea’s TraderTraitor hacking group, a group associated with previous cryptocurrency thefts. Blockchain intelligence companies also identified similarities with earlier operations attributed to North Korean state-sponsored actors.
Binance has stated that it would cover the losses using its Secure Asset Fund for Users (SAFU) and other corporate funds.
Understanding the technology behind the attack
Before examining how the attackers operated, it is necessary to understand several technologies that underpin cryptocurrency exchanges.
- Cryptocurrency wallets: Where are the coins actually stored?
One of the most common misconceptions about cryptocurrency is that coins are stored inside a digital wallet. In reality, cryptocurrencies exist as records on a blockchain, a distributed digital ledger that records transactions.
A cryptocurrency wallet stores or manages the cryptographic credentials required to control those assets. These credentials include private keys – the secret cryptographic value that allows its owner to authorise transactions associated with a particular blockchain address.
If someone obtains your private key, they may be able to transfer your cryptocurrency without needing your password, your permission, or your cooperation.
This is why private-key protection is one of the most important security requirements in cryptocurrency.
However, the Binance incident demonstrates that protecting the key itself may not be sufficient. If an attacker compromises the infrastructure that can request or authorise transactions, they may be able to exploit the wallet without directly stealing its private key. - Hot wallets and cold wallets
Cryptocurrency exchanges typically maintain different types of wallets.
Hot wallets – These are connected to systems that interact with the internet and blockchain networks and allow exchanges to process customer withdrawals and other transactions quickly.
Their primary advantage is convenience and operational efficiency. Their disadvantage is exposure.
Because hot wallets are connected to operational infrastructure, they are more accessible to attackers who compromise the systems responsible for managing them.
Cold wallets – designed to keep cryptocurrency credentials isolated from internet-connected systems.
Cold wallets may involve hardware security devices, offline signing systems or other arrangements that minimise exposure to remote attackers.
Cold wallets offer stronger protection against many remote attacks, but they introduce operational challenges – Transactions must be authorised through carefully controlled processes, which can make withdrawals slower.
A large cryptocurrency exchange must therefore balance security against operational requirements. The challenge is not simply to protect cryptocurrency from theft. It is to ensure that legitimate transactions can still be processed efficiently.
Binance’s compromised infrastructure was associated with hot-wallet operations, highlighting the risks of maintaining large quantities of cryptocurrency in systems that require continuous connectivity.
How the attackers infiltrated Binance
The precise sequence of events remains subject to investigation, but the information published so far provides a useful understanding of the attack.
Compromising a DevOps engineer’s laptop
Binance initially identified a potentially compromised laptop belonging to a DevOps engineer.
DevOps is a combination of development and operations. DevOps professionals help organisations develop, deploy, maintain and operate software and infrastructure.
These responsibilities frequently require elevated privileges as a DevOps engineer may need access to systems that ordinary employees cannot access.
This makes DevOps personnel attractive targets for sophisticated attackers.
The exact initial compromise mechanism at Binance has not yet been publicly established, but a compromised device could potentially result from a phishing attack, malware, credential theft, exploitation of an unpatched vulnerability, negligence, or another form of endpoint compromise.
It is important not to assume that the engineer deliberately facilitated the attack – Binance specifically stated that its investigation had not attributed responsibility to an individual employee.
Understanding containers and service infrastructure
Binance have reported that the compromised laptop potentially allowed attackers to access a service container.
What is a container?
Rather than installing every application directly onto a physical server, organisations frequently use virtualisation and containerisation. A container packages an application together with the components it needs to run.
Containers allow organisations to deploy applications rapidly, and consistently across different environments.
Docker is one of the most widely recognised examples of container technology.
A cryptocurrency exchange might operate separate containers for:
- Customer account management.
- Transaction processing.
- Blockchain connectivity.
- Monitoring and logging.
- Withdrawal management.
Containers are useful because they make applications easier to deploy, maintain and scale, but containers are not automatically secure – If an attacker compromises a container, the consequences depend on how it has been configured and what permissions it possesses.
A container with excessive privileges may provide access to sensitive systems or data. In some circumstances, attackers may be able to move from a compromised container into other infrastructure, such as the host running the container – This is known as container escape.
However, a container escape is not necessarily required for a serious compromise. If a container already has access to sensitive services, the attacker may simply abuse those permissions.
This is an important distinction in the Binance incident – The publicly available information indicates access to a service container, but it does not establish that the attackers performed a traditional container escape.
Privilege escalation and the abuse of trusted access
Privilege escalation (privesc.)occurs when an attacker obtains permissions beyond those originally available to them.
There are two broad categories of privesc.
- Vertical privilege escalation – where an attacker obtains higher-level privileges, such as moving from an ordinary user account to administrator or root.
- Horizontal privilege escalation – where an attacker obtains access to another account or resource with similar privileges.
In a sophisticated infrastructure attack, privesc may involve exploiting operating-system vulnerabilities, stealing credentials, abusing service accounts or taking advantage of excessive permissions.
Attackers do not always need to escalate privileges though. If the initial compromised account already has access to a powerful service, they may simply abuse that access.
This is known as privilege abuse.
In the Binance incident, the compromised infrastructure reportedly allowed attackers to interact with services involved in transaction authorisation.
Compromising transaction authorisation
Cryptocurrency transactions require cryptographic authorisation as proof of the transaction. When a user sends cryptocurrency, the transaction must be digitally signed using the appropriate private key.
The blockchain network verifies this signature before accepting the transaction.
A simplified process looks like this:
- A transaction is created.
- The transaction is submitted for signing.
- The private key generates a digital signature.
- The signed transaction is broadcast to the blockchain.
- The blockchain network validates the transaction.
- The transaction is added to the blockchain.
The digital signature proves that the transaction was authorised by the holder of the relevant cryptographic key – It does not prove that the transaction was legitimate from a business or security perspective.
This is a crucial distinction.
The blockchain can verify that a transaction was correctly signed, but it cannot necessarily determine whether the transaction was authorised by the organisation’s security policies.
This is where the Binance attack becomes particularly interesting. The attackers reportedly compromised infrastructure responsible for authorising transactions.
This suggests that the attackers may have exploited the systems responsible for controlling or invoking the signing process rather than obtaining the cryptographic keys themselves.
The precise technical mechanism remains under investigation.
Smart contracts
Another important technology involved in the attack was the use of smart contracts.
As mentioned earlier, a smart contract is a program deployed on a blockchain that can execute predefined instructions when certain conditions are satisfied.
Smart contracts are commonly used for:
- Cryptocurrency exchanges.
- Lending platforms.
- Automated financial transactions.
- Token transfers.
- Decentralised applications.
Unlike traditional software, smart contracts can directly control blockchain assets and once deployed, their behaviour is generally governed by the blockchain’s execution rules.
Ethereum is one of the best-known platforms for smart contracts.
The Binance attack involved a technique associated with Ethereum’s EIP-7702 standard (Ethereum Improvement Proposal)
The proposal describe changes or enhancements to the Ethereum blockchain and its associated technologies.
EIP-7702 introduced a mechanism that allows an externally owned Ethereum account, commonly called an EOA (Externally Owned Account), to temporarily or persistently operate with delegated smart-contract functionality.
An EOA is a traditional Ethereum account controlled by a private key.
Historically, such accounts could sign transactions but could not directly execute arbitrary smart-contract logic as an account – EIP-7702 changes this capability by allowing an account to delegate certain behaviour to code.
This enables functionality such as:
- More sophisticated transaction authorisation.
- Account abstraction features.
- Transaction batching.
- Flexible account management.
- Smart-contract-based wallet behaviour.
If an attacker can obtain the ability to modify or invoke delegated account functionality, they may be able to manipulate the account’s behaviour.
Blockchain investigators have reported that the Binance attacker used EIP-7702-related functionality to turn a compromised hot wallet into a mechanism for transferring funds to attacker-controlled addresses.
Now, here’s where it gets interesting – As soon as a transaction takes place, a lot of scrutiny will occur to ensure the transaction is legitimate – In this case, the attacker(s) reportedly prepared multiple authorisations in advance to support the operation and allow the transactions to take place as quickly as posssible.
This demonstrates how a legitimate blockchain feature can become dangerous when combined with compromised transaction-authorisation infrastructure.
The technology itself was not necessarily defective. The security problem was the ability to misuse the functionality with access to valuable assets.
Automation and the speed of cryptocurrency transactions
Once the attackers obtained sufficient access, they were able to move cryptocurrency rapidly.
Reports indicate that the main theft occurred across multiple blockchain networks, with a substantial portion of the funds transferred within approximately 20 minutes.
This speed presents an enormous challenge for incident responders.
In traditional banking, fraudulent transfers may sometimes be delayed, reversed or blocked through centralised payment systems.
Blockchain transactions operate differently – Once a transaction has been confirmed, it is generally irreversible.
There is no central administrator who can simply press a button to reverse a Bitcoin or Ethereum transaction.
The speed of the attack also demonstrates the importance of automation – Scripts can execute transactions much faster than a human operator could manually perform them.
Automation can also allow attackers to:
- Generate large numbers of transactions.
- Transfer assets across multiple wallets.
- Monitor transaction confirmations.
- Initiate additional transfers.
- React to changes in network conditions.
What happened to the stolen cryptocurrency?
One of the advantages of many public blockchains is that transactions are visible. Bitcoin and Ethereum transactions can be examined using blockchain explorers and specialist forensic tools.
Investigators can trace cryptocurrency transfers between addresses and identify relationships between transactions, but visibility does not necessarily mean that the identity of the person controlling a wallet address is known.
An address may be associated with a particular individual or organisation only after lengthy investigations.
Attackers therefore attempt to make cryptocurrency tracing more difficult.
The Binance attackers reportedly used several techniques.
- Multiple wallets
Funds were transferred through numerous addresses to complicate the tracing process. - Decentralised exchanges
Decentralised exchanges allow users to exchange cryptocurrency directly through blockchain-based systems without relying on a traditional centralised exchange. - Cross-chain bridges
Cross-chain bridges allow assets or representations of assets to move between different blockchain networks. E.G. a user may move value between Ethereum and another blockchain using a bridging service. - Decentralised lending
The attackers reportedly used Aave, a decentralised lending protocol. Aave allows cryptocurrency holders to deposit assets as collateral and borrow other cryptocurrency assets against that collateral.
The attackers reportedly used stolen stablecoins as collateral to borrow Ether. This is significant because it allows attackers to transform one type of cryptocurrency into another without necessarily selling it through a conventional exchange.
These techniques do not make cryptocurrency impossible to trace. They simply increase the complexity of the investigation and may make recovery more difficult.
Stablecoins and the ability to freeze cryptocurrency
As mentioned above, the attackers also used stablecoins as part of their attempt to obfuscate their transaction history – Stablecoins are cryptocurrencies designed to maintain a relatively stable value, often by tracking the value of a traditional currency such as the US dollar.
Examples include USDT (A.K.A. Tether) and USDC (A.K.A. USD coin)
Unlike Bitcoin, many stablecoins are issued by centralised organisations.
Certain stablecoin issuers can freeze tokens associated with specific blockchain addresses. This means that even if an attacker successfully steals stablecoins, the issuer may be able to prevent those assets from being transferred.
This capability helped investigators respond to the Binance theft. Blockchain intelligence companies reported that billions of dollars in affected assets had been frozen or otherwise restricted.
However, Bitcoin and Ether do not have equivalent centralised issuers capable of freezing individual addresses. This is why attackers may attempt to convert stolen stablecoins into assets that cannot be frozen by a central issuer.
The process creates a race between attackers attempting to move the funds and investigators attempting to identify and restrict them.
To date, Binance says it has covered 90% of the $6.3bn (£4.7bn) stolen in the attack. Around $3 billion of the affected assets was frozen by October 30. However, freezing funds is not the same as recovering them.
Similarly, the restoration of funds is not the same as recovering the stolen assets – much of this has come from various funds held by the exchange, as well as its corporate treasury.
In addition to this eye-watering amount, investors nervous at the potental loss of more funds have reportedly withdrawn over $4B of funds to safer alternatives
Conclusion
The Binance theft demonstrates that cryptocurrency security is not simply a matter of protecting private keys or deploying secure blockchain technology.
It requires protecting the entire infrastructure surrounding those assets.
The attackers reportedly compromised trusted operational systems, gained access to transaction-authorisation infrastructure and used legitimate blockchain functionality to transfer enormous quantities of cryptocurrency.
The incident illustrates several fundamental cybersecurity principles:
- Trusted systems can become attack vectors.
- Privileged accounts represent significant security risks.
- Infrastructure compromise can bypass otherwise strong cryptographic protections.
- Automation can dramatically increase the speed and scale of an attack.
- Blockchain transparency does not guarantee asset recovery.
- Legitimate technology can become dangerous when combined with excessive permissions.
Perhaps the most important lesson is that cryptographic security cannot compensate for compromised operational security.
A blockchain may correctly validate every transaction it receives while the organisation controlling those transactions is being systematically compromised.
For cybersecurity professionals, the Binance attack is a reminder that security must be designed around the complete system – not simply its most visible or technically sophisticated component.
In cryptocurrency, the vault may be digital, but the people, systems and processes responsible for opening it remain very much part of the traditional cybersecurity problem.
