The $6.4B Binance Heist Started With One Laptop. Check Your Admins.

By Felipe Isaza, FUNCSHUN | Companion to CyberScope Weekly Vol 71

You don't hold billions in crypto. But you probably have someone whose laptop can reach your Microsoft 365 admin center, your firewall, your cloud console and the file share where your CUI lives. That's the part of the Binance story worth your time.

What happened

At about 20:05 UTC on Oct 29, 2026 (4:05pm Eastern), attackers started draining Binance's hot wallets. Binance puts the loss at about $6.3 billion. Elliptic counts $6.43 billion across 11 blockchains, and Chainalysis says about $6.4 billion. Elliptic says that's more than four times the $1.46 billion stolen from Bybit in 2025, and almost certainly the largest single theft of any kind.

It was fast. Elliptic says most of the wallets were drained within about 30 minutes, with a second, smaller wave after 23:00 UTC. It was also planned. The attacker funded a fresh wallet through Tornado Cash a day or so earlier and rehearsed the "sweeper" contract about four hours before using it on Binance.

On Oct 31, the FBI attributed the theft to North Korea, naming the activity "TraderTraitor." Elliptic notes the FBI had already tied the Bybit and DMM Bitcoin thefts to the same group.

Binance says it will cover every dollar from its SAFU fund and company money. About $3 billion has been frozen on-chain, mostly stablecoins. Withdrawals started reopening in phases on Nov 1, and as of Nov 2 Binance said it had covered about 95% of the stolen assets.

Why one laptop mattered

Binance's first finding, on Oct 30, was this: the incident "may involve a compromised DevOps engineer's laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions." It found no sign that wallet private keys leaked.

Read that again. The attacker didn't break the cryptography. Elliptic's on-chain analysis says the attacker got Binance's own systems to sign the transactions. From the outside, a theft like that can look like normal withdrawals.

Binance has since said the laptop wasn't the whole story. A second update the same day said the investigation "has uncovered additional points of breach." Co-CEO Richard Teng said it "was not carried out by one person." He also said the attacker's tooling destroyed itself and its traces as it ran, and that one step "did not pass through our normal approval controls." As I write this on Nov 3, Binance hasn't published its full technical post-mortem, so we don't know the whole path yet.

We don't need the whole path to learn the lesson. Elliptic points out that Bybit looked the same: North Korean hackers compromised a developer's machine at the wallet provider and changed what Bybit's signers approved. In both cases, attackers went after the people and machines around the vault, not the vault.

Now think about your shop. Who has a laptop that reads email, browses the web, and is also signed in to your admin consoles? If that laptop were compromised tonight, what could it reach, and how long before anyone noticed?

Why this matters if you handle CUI

CMMC Phase II is suspended. Your obligations aren't. DoD's CIO page says Phase II, originally due Nov 10, was suspended on Jul 13 and Phase I self-assessments stay in place. DFARS 252.204-7012 still requires NIST SP 800-171 on systems that handle covered defense information, and a report to DoD within 72 hours of discovering a cyber incident.

NIST SP 800-171 Rev 2 already describes the controls that make one laptop less dangerous. It just doesn't call them that. The ones I'd look at first:

• 3.1.5 Least privilege, including for privileged accounts.
• 3.1.6 Use non-privileged accounts when you aren't doing admin work. That's email and browsing.
• 3.1.7 Keep regular users from running privileged functions, and log it when admins do.
• 3.5.3 MFA for local and network access to privileged accounts.
• 3.4.8 Block unauthorized software, or allow only approved software.
• 3.3.1, 3.3.2, 3.14.6 and 3.14.7 Keep logs, tie actions to a person, and watch for unauthorized use.

If your SSP says these are "implemented," an assessor or prime will ask you to show it. Your SPRS score is a statement you sign.

What to check this week

1. List everyone with admin rights. Include Microsoft 365, Entra ID, firewalls, backup consoles, cloud accounts, GitLab or GitHub, and your RMM or remote support tool. Write down which device each person administers from. In my experience, this list is always longer than people expect (3.1.5, 3.4.1).
2. Split admin accounts from everyday accounts. Every admin gets a separate account used only for admin work. No mailbox, no web browsing, no Teams chats on it (3.1.6).
3. Give admin work its own device. A privileged access workstation is a locked-down laptop or virtual desktop used only for admin tasks. If a full PAW program is too much right now, start with your global admins and whoever manages the firewall.
4. Remove standing admin rights. Use just-in-time access, such as Entra Privileged Identity Management, so admin roles are requested, time-limited and logged. Nobody should be a global admin all day by default (3.1.5, 3.1.7).
5. Use phishing-resistant MFA on every admin account. 3.5.3 requires MFA for privileged accounts. I'd set the bar at FIDO2 security keys or passkeys, not text codes or push approvals, and pair it with conditional access that only allows admin sign-ins from company-owned, locked-down devices.
6. Lock down the admin devices themselves. Run EDR, turn on application allowlisting so only approved software runs (3.4.8, 3.14.2), and remove local admin from daily-use accounts.
7. Get secrets off laptops. Search for API keys, cloud credentials and passwords in scripts, browser storage, text files and code repositories. Move them into a secrets manager or vault, rotate anything that's been sitting on an endpoint, and limit what each key can do (3.5.10, 3.13.10).
8. Put a second check on high-risk actions. For actions that move money, change MFA, create admins or export data, require approval from a second person through a separate channel. Binance said one step skipped its normal approval controls. Find out where yours could be skipped.
9. Watch the admin accounts. Alert on new admin role assignments, sign-ins from new devices or locations, MFA changes and bulk downloads. Send those logs somewhere the admin account can't delete them (3.3.1, 3.3.2, 3.14.6, 3.14.7).
10. Rehearse the bad night. Pick one admin laptop and walk through it: who notices, who revokes sessions and tokens, who decides whether this is reportable, and who files the DoD report inside 72 hours. Preserve the images and logs before anyone rebuilds the machine.

The bottom line

Binance is the world's largest crypto exchange, with a security team most of us will never have. From what's public so far, its losses trace back to a compromised machine that could reach too much, and a step that skipped its normal checks. You don't fix that by buying one more tool. You fix it by deciding what each admin account can touch, from which device, and who's watching when it does.

If you can't answer "what could one admin laptop reach?" today, that's the place to start.

Want a second set of eyes on your admin access before an attacker gets one? Book a Cyber Risk Strategy Call: [https://start.funcshun.com]

Felipe Isaza is the founder of FUNCSHUN Cybersecurity, which helps defense contractors meet CMMC and NIST SP 800-171 requirements.

---

Sources

• Binance, "Security Incident Update (2026-10-30)": https://www.binance.com/en/support/announcement/detail/c5a8729a97ac486d963784d96c5642d7
• Binance, "Security Incident Update #2 (2026-10-30)": https://www.binance.com/en/support/announcement/detail/d3306d9dca5243548c813b605e1d1751
• Elliptic, "The largest theft in history: North Korea behind the $6.4 billion Binance hack" (Oct 30, 2026, final update Nov 1): https://www.elliptic.co/insights/binance-largest-hack-in-history/
• Chainalysis, "Binance Hack: Tracing the $6.4 Billion Theft to North Korea": https://www.chainalysis.com/blog/binance-exploit-latest-findings-and-response/
• FBI, "North Korea Responsible for $6 Billion+ Binance Attack" (Oct 31, 2026): https://www.fbi.gov/investigate/cyber/alerts/2026/north-korea-responsible-for-6-billion-binance-attack
• CNBC, "Binance resumes withdrawals following $6.3 billion hack" (Oct 31, 2026, updated Nov 1): https://www.cnbc.com/2026/10/31/binance-hack-asset-coverage-withdrawals.html
• CNBC, "Binance sees $3.64 billion in net outflows as withdrawals resume after massive hack" (Nov 2, 2026): https://www.cnbc.com/2026/11/02/binance-outflow-hack-bitcoin.html
• CoinDesk, "Binance discovers multiple breach points in $6.3 billion attack" (Oct 30, 2026): https://www.coindesk.com/tech/2026/10/30/binance-uncovers-wider-breach-in-usd6-3-billion-exploit-targets-sunday-withdrawal-restart
• DoD CIO, CMMC program page (Phase II suspension): https://dodcio.defense.gov/CMMC/
• DFARS 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting: https://www.acquisition.gov/dfars/252.204-7012-safeguarding-covered-defense-information-and-cyber-incident-reporting
• NIST SP 800-171 Rev 2, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations: https://csrc.nist.gov/pubs/sp/800/171/r2/upd1/final