Binance Hack: $6.3 Billion Left Without Approval. Who Can Move Your Company's Money Without Your Sign-Off?

If you believe no transfer leaves your company's account without your sign-off, the Binance hack is a good reason to test that belief today. On the evening of October 29, 2026, about $6.3 billion left the wallets of Binance, the world's largest crypto exchange, in unauthorized withdrawals, most of it in about 20 minutes. The exchange's co-CEO said part of the operation did not pass through its normal approval controls. The lesson for your business has nothing to do with crypto: list every path that can move money or change a beneficiary's account, and make each one need two people, two devices and a log nobody can erase.

What happened at Binance, in numbers

According to the second official update Binance published on October 30, its hot wallets, the internet-connected wallets that process customer withdrawals, were compromised at around 20:05 UTC, with a loss of about $6.3 billion. The exchange paused withdrawals, said about $3 billion had been frozen on-chain with the help of partners, and set aside more than $6.34 billion of company funds to cover the losses, including $5 billion held in the exact tokens that were stolen, or about 80% of the amount. It targeted a phased restart of withdrawals within about 34 hours of that update, with a proof-of-reserves report by November 2.

TRM Labs' analysis of the blockchain data adds important detail: the funds left on 10 networks, preparation began at least 36 hours before the theft, the attacker rehearsed the tool on another wallet before using it, and prepared 50 pre-signed authorizations so that one of them would be valid at the moment of execution. TRM puts the total at $6.36 billion, about four times the $1.5 billion Bybit hack of February 2025. TRM and Elliptic attribute the attack to TraderTraitor, a group linked to North Korea, while Elliptic notes that no government has confirmed the attribution yet.

What Binance has said about how it happened

The initial investigation pointed to a compromised laptop belonging to a DevOps engineer, which let the attacker reach a service container and submit unauthorized withdrawal transactions. The exchange later said its subsequent investigation had uncovered additional points of breach, and that it had found no evidence that its wallets' private keys were leaked. The co-CEO said the attack was not carried out by one person, that the attacker used a self-destruct mechanism that destroyed tooling and traces as it ran, and that the delegation used on Ethereum did not pass through Binance's normal approval controls.

Put simply, the attacker did not crack the vault. The attacker got Binance's own systems to sign the transfers. TRM's assessment is that the most likely explanation is an ability to make the signing system sign transactions of the attacker's choosing, across different networks and different keys, within about half an hour.

Why this matters to a company that holds no crypto at all

Because every company runs a small version of that signing system: the corporate banking portal, the payment file the accountant exports from the accounting system and uploads to the bank, the screen where a supplier's bank details are edited, the refund permission in your payment gateway, the monthly payroll file. As the owner you see the official approval path, request then manager then finance, but an attacker looks for the side path: a system account that uploads files automatically, an IT admin who can change an IBAN, or an integration key at an outside provider that can execute a transfer.

There are two more lessons. The first is speed: most of the money left in about 20 minutes, and no employee can keep up with that by hand, so protection has to be limits and alerts that work on their own. The second is preparation: the attacker got ready 36 hours ahead and tested the tool, which means early warning signs existed for anyone watching. We wrote earlier about how one free streaming site on a work laptop can hand your company passwords to attackers, and the device of whoever holds the permissions is the most valuable target in the company.

What to review in your company this week

• Map every path money can leave by: write down each person and each system that can start a transfer, approve it, change a beneficiary's account or issue a refund, including system accounts, integration keys and outside providers.
• Two people and two devices for every transfer: whoever enters a transfer does not approve it, and approval happens on another device. This is the segregation of duties principle in the Essential Cybersecurity Controls: completing a task takes more than one person, each with different privileges. Tie it to an approval matrix that sets who signs what.
• Limits and instant alerts: ask your bank for a daily transfer limit and an instant alert to the owner's phone on every large transfer and whenever a beneficiary is added or edited.
• Admin permissions sized to the need: turn on multi-factor authentication for every remote login and every privileged account, review the list of people holding those permissions on a schedule, and delete the accounts of former employees and finished vendors.
• A log the attacker cannot wipe: the Binance attacker erased traces while working. Enable event logs for privileged accounts and remote access, keep a copy outside the system itself, and retain it for at least 12 months, as the controls require.
• A plan for the first minutes: decide who calls the bank to stop a transfer, who disables the suspect account, and where the emergency numbers are. In the Binance case, Tether froze the attacker's main receiving wallet 37 minutes after the largest sweep, and that speed is what saved a large share of the money.

What do Saudi controls say?

The Essential Cybersecurity Controls ECC-2:2024 issued by the National Cybersecurity Authority are mandatory for government agencies and their affiliated entities, and for private sector entities that own, operate or host Critical National Infrastructure, and the NCA strongly encourages all other entities in the Kingdom to use them. They map directly onto the Binance lessons: multi-factor authentication for remote access and privileged accounts (2-2-3-2), the need-to-know, least privilege and segregation of duties principles (2-2-3-3), privileged access management (2-2-3-4), periodic review of identities and access rights (2-2-3-5), and event logs for privileged accounts and remote access, monitored continuously and retained for at least 12 months (2-12-3).

The Origami view

We read the Binance hack as a lesson about approval paths, not about crypto. Most companies design approval for the official path and forget the side paths: the system account that uploads the payment file, the user who can edit an IBAN, the integration key that can execute. Those side paths are the first thing an attacker looks for.

When we build a custom system that touches money, such as a purchasing-cycle system or a supplier payments portal, we recommend making approval part of the design from day one: two different people to enter and approve, amount limits, and a log of every change to beneficiary data. If you need a ready-made accounting system rather than a custom one, take a look at Fahim.

Conclusion

You do not need a crypto wallet to learn from the largest crypto theft on record. Set aside two hours this week with your accountant and your IT lead: write down every path money can leave by, split entry from approval across two devices, ask the bank for limits and alerts, review who holds admin rights, and keep logs out of reach of whoever runs the system. If you want a review of the approval paths in your systems, contact us or see our services.

Sources

• Binance — Security Incident Update #2, October 30, 2026: time of the breach, amount, frozen and reserved funds, withdrawal restart target and proof-of-reserves report.
• TRM Labs — North Korea Steals USD 6.36 Billion From Binance in the Largest Hack in History, October 29, 2026: the ten networks, duration of the theft, preparation, the 50 authorizations and the Tether freeze.
• Elliptic — The largest theft in history, October 30, 2026, updated October 31: Binance statements on approval controls and the self-destruct mechanism, and the status of attribution.
• National Cybersecurity Authority — Essential Cybersecurity Controls ECC-2:2024: scope and controls 2-2-3 and 2-12-3.
• BBC News — Crypto giant Binance attempting to recover $6.3bn stolen in hack linked to North Korea, October 30, 2026: the co-CEO's statements on additional points of breach.