On Thursday evening Binance, the world’s largest cryptocurrency platform, suffered a cyberattack: according to the company itself, around $6.3 billion is at stake. Roughly $3 billion has reportedly been frozen, withdrawals remain suspended, and the company says it will cover all losses.
Binance’s initial explanation points to a breached engineer’s laptop as a possible entry point, though the investigation remains open. That’s why the story matters even to companies with nothing to do with cryptocurrencies: in every company there’s a computer from which someone could reach the cash.
In a country of small businesses like San Marino, it’s worth asking which computer that might be in your own company.
What happened
The bulk of the funds left Binance’s online wallets in roughly 20 minutes, according to analytics firm TRM Labs. The platform announced the suspension of withdrawals, but according to analytics firm Bitquery, the last illicit outflows occurred more than an hour after that announcement — nearly four hours after the attack began.
Tether and Circle, the companies that issue the two main dollar-pegged stablecoins, froze about $2.6 billion between them, according to TRM Labs — the largest share of the frozen funds.
Overnight, Binance offered its first explanation: a compromised laptop belonging to an engineer may have allowed the attackers to reach an internal component and send unauthorized withdrawals. A few hours later, the company added that it had found other breaches and had no evidence of leaked private keys — the codes that grant access to wallets.
Co-CEO Richard Teng clarified that a single click was not enough, that the breach did not rely solely on one person’s permissions, and that the investigation does not point blame at any specific individual. On Friday he added that a delegation on an online wallet had bypassed normal approval procedures, and that a self-destruct mechanism had erased the traces.
The definitive cause has not yet been published. According to TRM Labs, the most likely explanation is that the attackers managed to get Binance’s own system to sign the transactions they wanted.
TRM Labs attributes the attack, with a high degree of confidence, to TraderTraitor, a group linked to North Korea; Chainalysis and Elliptic point to the same suspect.
These are assessments from private firms: Binance has not confirmed them, and so far no government has either. It is the same group the FBI named in connection with the 2025 attack on the Bybit platform.
In that case, according to Safe, the wallet provider involved, the starting point was the computer of one of its own developers.
This is the largest cryptocurrency theft ever recorded — about four times the size of the Bybit hack. According to Elliptic, it is almost certainly the largest theft of any kind.
Does artificial intelligence play a role?
For now, no credible source claims AI was used in this particular attack.
One connection, however, deserves attention. On the very day of the attack, Microsoft published a report on artificial intelligence use by North Korean hacking groups. Among the most advanced, it names Jade Sleet — the name it uses for the group the US cybersecurity agency calls TraderTraitor.
The main use of AI in these operations is to deceive people — for example, through fake recruiters who contact developers.
The report does not mention Binance, and Microsoft stresses that human operators still lead these operations.
If you have funds on Binance
Binance says customer funds are safe and that it has set aside more than $6.3 billion of its own funds, of which about $5 billion is already in the affected tokens. On Friday, Teng said withdrawals could reopen within roughly 40 hours — by Sunday, if tests go well. That’s a target, not an official deadline. A full proof-of-reserves is promised by Monday, 2 November.
This is a corporate commitment, not a public guarantee, and it cannot yet be independently verified, since Binance has not published the addresses holding that $5 billion. Teng says a corporate wallet was hit, but according to the outlet CoinDesk, the drained wallets appeared in the 1 October proof-of-reserves report among those backing customer balances.
Italian residents have an extra reason to pay attention.
In the register kept by ESMA, the European securities markets authority, checked on 30 October, Binance does not appear among authorised providers. In June, the company withdrew its application filed in Greece and said it intended to pursue authorisation in another member state.
In Italy and other countries where it had local entities, since 1 July most customers had effectively been left with only the ability to withdraw — with differences that Binance says depend on country and account type.
That withdrawal function is precisely the operation the company has now suspended.
In the meantime, three rules apply to everyone. Don’t click on messages or emails urging you to “secure your account” — after an attack, scammers work at full speed. Don’t pay anyone to unlock or recover funds. Save your balances and transaction history with dated screenshots.
Why this matters even for companies without cryptocurrencies
Binance has not yet explained exactly how the laptop was compromised, and what follows is not a reconstruction of its specific case. Remove cryptocurrency from the equation, and a question remains that applies to any company: if someone breaks into the computer of whoever manages your systems tomorrow, how many doors would still stand between them and your money?
An attack of this scale can hit even the largest platform in its industry. In smaller companies, often there’s only one door. The outside IT contractor has used the same passwords for years. Online banking is accessed from the same computer used to check email. A wire transfer is authorised by a single person, from their phone.
Your company is unlikely to be the target of an attack on this scale. But the infected attachment and the fake supplier email with a changed IBAN are already arriving — and the underlying question is the same.
What to do, in practice
First: draw up a list of who can do what. Who can access the servers, the email, the management software, the banking systems. The list should also include external contractors and anyone who no longer works with you. If the list doesn’t exist, start there.
Second: separate your computers. Sensitive operations should be carried out on a dedicated computer, separate from the one used for everyday tasks.
Third: never leave money decisions to one person alone. Significant wire transfers and IBAN changes should require sign-off from two people. If one person’s computer is compromised, the second person is the last line of defence.
Fourth: spot it quickly. You need alerts for unusual logins and out-of-pattern transactions. If at Binance the bulk of the money left in about 20 minutes, who in your company would notice — and after how many days?
A computer can always be breached. What you can control is what the intruder finds once inside, and how many doors remain for them to open.
If no one can tell you who holds the keys to your company, you’ve already found the first door to close.
Osservatorio Strategic.sm
——
If the list doesn’t exist, we’ll help you build it. Strategic is available to anyone who wants to find out who really holds the keys to their company, close off unnecessary access, and secure their payments.
Just get in touch via strategic.sm.
