Binance has published its first account of how attackers stole about USD 6.34 billion on 29 October. There was no flaw in a blockchain at the start of this story. It began with engineers doing ordinary things: installing a tool, taking a call from a recruiter and downloading a coding test.
You do not need to run a crypto exchange to learn from it. Any business with developers, system administrators or IT contractors has people whose laptops can reach systems that matter. Abu Dhabi's Financial Services Regulatory Authority said it was aware of the incident, so this is a story with a local audience too.
What Binance says happened
This is an initial report. The investigation continues and independent firms are being engaged to review it. The FBI has attributed the attack to North Korea, which denies involvement.
- June. A Wallet DevOps engineer searched for a popular AI coding tool and downloaded a tampered Homebrew installation. Binance detected it, replaced the device and rotated credentials. But the engineer's role, and his colleagues on the wallet team, had already been exposed to the attackers.
- September. A second engineer, whose profile on a legitimate job platform mentioned Binance, was approached by a fake project director. After a video interview with a fake HR representative, a "CEO" of a fictitious company told him over a chat app to download an assignment to his work computer.
- The malware. The assignment ran malicious code during setup and replaced a legitimate developer tool. Binance says its endpoint security tools did not detect it at the time.
- 20 October. The attackers used that computer and an internal AI tool to gain control of the first engineer's system and a third engineer's system. Binance has not explained how the AI tool was used. The first engineer's computer held a container deployment token.
- 29 October. The attackers used stolen credentials to deploy a container and reach an internal wallet signing service. Funds moved out over just under four hours.
Suspending withdrawals did not stop everything, because malicious authorisations already sat on the blockchain, outside Binance's normal withdrawal systems. About USD 2.85 billion has been frozen or intercepted, and Binance says it will cover the loss itself.
Why this applies to your business
Replace "wallet signing service" with whatever would hurt most: your payment run, your cloud admin console, your backups or your domain controllers. The chain still works. An outside approach reaches a trusted person, their laptop holds a useful credential and one internal system trusts another.
Three points stand out. Recruitment is now an attack route, and staff exploring a new job are unlikely to tell their employer. Security tools can miss new malware. And a detected incident may still have told the attacker who to target next, as June shows.
What to do now
- Treat outside code as hostile. Set a clear rule that coding tests and unsolicited files never run on work devices. Anyone who wants to try one should use a separate, disposable machine.
- Talk openly about recruiter scams. Tell staff these approaches exist, and give them a blame-free way to report one, even if they were looking for a new job.
- Control where tools come from. Install developer tools from approved sources or an internal repository, not from a search result.
- Separate privileged work. Give administrators and senior engineers a dedicated device or locked-down environment for production access, away from email, browsing and chat.
- Stop leaving keys on laptops. Find long-lived tokens and passwords on developer machines. Move them into a secrets manager and use short-lived credentials where you can.
- Treat internal AI tools as privileged systems. Give them their own identities and the least access that works, and log what they do.
- Require two people for high-risk actions. Payments, production deployments and changes to backups should need a second approval on a separate device.
- Watch behaviour, not just malware. Alert on new connections from engineers' machines, unusual logins and credentials used from unexpected devices.
- Rehearse the shutdown. Work out in advance what stops the damage and what will keep running after you press the button. Binance's report shows these can be different things.
- After any incident, ask what the attacker learned. Warn the affected person's colleagues and watch them closely, even once the device is replaced.
Closing thoughts
Most businesses will never face an attacker with this patience. But the techniques are not exotic, and we covered a close relative in our guide to help-desk impersonation on Teams. The practical question is simple: if one engineer's laptop were taken over tomorrow, how far could an attacker get?
At COMMPRO Technologies, we supply security, networking and Microsoft 365 solutions across the UAE and GCC. Want to know how far one laptop could reach in your network? Contact the COMMPRO team and we will help you review your exposure and plan the next steps.
