Blog
Binance hack: what happened and 7 security lessons for any business
In late October 2026, Binance suffered the largest cryptocurrency theft on record: around $6.3 billion, according to the FBI. Even if your business has nothing to do with crypto, the way these groups operate is the same one used against companies of every size. Here is what is known and what is worth learning.
What is known
- When: the theft took place around 29 October 2026.
- How much: around $6.3 billion according to the FBI; blockchain analytics firm Elliptic puts it at about $6.4 billion. It is the largest cryptocurrency theft in history.
- Who: the FBI attributes it to TraderTraitor, a group linked to North Korea that was also blamed for the $1.5 billion Bybit theft. North Korea denies it.
- Afterwards: Binance suspended withdrawals and reopened them in phases from 1 November. The FBI published hundreds of addresses linked to the theft so that exchanges can block those funds.
How these groups usually operate
Binance has not yet published a full technical report and some details remain unconfirmed. What US authorities have documented is TraderTraitor’s usual way of working: they do not break cryptography, they deceive people. They contact technical staff with fake job offers or credible messages, get them to install software containing malicious code and, from that computer, move towards the systems that move money.
In other words: the weak point was not a digital safe, but the computer of a person with access.
7 lessons for any business
- Training against social engineering. Job offers, invoices, “technical tests” or files arriving via LinkedIn or Telegram are a common way in.
- Least privilege. Each person should only have access to what they need. Accounts with administrator or payment rights should be separate and monitored.
- Dual approval for moving money. No major payment or bank-account change should depend on a single person or a single email.
- Phishing-resistant two-step verification (security keys or apps rather than SMS) for email, banking and critical systems.
- Managed work devices. No installing software of dubious origin on computers with access to sensitive systems. A good antivirus with detection and response (EDR) helps, but is not enough on its own.
- Monitoring and alerts. Unusual activity at unusual hours must trigger an alert that someone reviews.
- Response plan. Binance could stop, communicate and reopen in phases because it had a plan. Does your company know what to do in the first hour of an incident?
What if my company holds or accepts crypto?
If your company holds cryptocurrency, the general advice is not to keep more on exchanges or internet-connected wallets than you need to operate, and to store the rest in cold wallets with multiple signatures. If you accept crypto payments through a platform, check what guarantees it offers and what would happen if it suspended withdrawals for a few days, as Binance did.
How we help
At GAITS we review your company’s access, two-step verification, email and devices, and prepare a simple response plan. Ask us for a cybersecurity review. Read also how the Nvidia case shows that people are the main target.
Want to review access and security in your company?
Ciberseguridad esencial