On the evening of Thursday 30 October, Binance, the world’s largest cryptocurrency platform, suffered a cyberattack: according to the company itself, around $6.3 billion is at stake.
On Sunday withdrawals gradually resumed, and Binance says it has already covered roughly 95% of the stolen funds with its own money.
On Saturday the FBI attributed the theft to North Korea, which denies the accusation.
Binance’s first explanation points to an engineer’s compromised laptop as a possible entry point. The company later found additional breaches, stresses that the investigation does not assign blame to anyone in particular, and has not yet published the full technical analysis. This is why the story matters even to companies with nothing to do with cryptocurrencies: every business has a computer that can lead straight to the cash register.
In a country of small businesses like San Marino, it’s worth asking which computer that is in your own company.
How it happened
The bulk of the money left Binance’s online wallets in about 20 minutes, according to analytics firm TRM Labs. Binance suspended withdrawals. According to blockchain analytics firm Bitquery, which reconstructs on-chain movements, the last illicit outflow occurred more than an hour after the suspension was announced — nearly four hours after the attack began.
Part of the funds was blocked. Binance reports around $3 billion frozen. According to analytics firm Elliptic, $2.85 billion — 44% of the theft — has been frozen or seized, almost all of it in dollar-pegged stablecoins issued by Tether and Circle. That leaves attackers with roughly $3.3 billion in cryptocurrencies that no issuer can freeze.
Overnight, Binance offered its first explanation. An engineer’s compromised laptop may have allowed the attackers to reach an internal component and send unauthorized withdrawals. A few hours later, the company added that it had found other breaches and had no evidence of leaked private keys — the codes that grant access to wallets.
Co-CEO Richard Teng clarified that a single click was not enough, that the attackers did not rely solely on one person’s permissions, and that the investigation does not point the finger at anyone specific. On Friday 31 October, he added that a delegation on an online wallet bypassed normal approval procedures, and that a self-destruct mechanism erased the traces.
The definitive cause has not yet been made public, and Binance has promised a full analysis once the investigation is complete. TRM Labs believes the most likely explanation is that the attackers managed to get Binance’s own system to sign the transactions they wanted.
On Saturday 1 November, the FBI attributed the theft to North Korea, specifically to TraderTraitor, the same group it had named for the 2025 attack on the Bybit platform.
It published 628 addresses linked to the attackers. Together with the Secret Service and the US tax police, it asked platforms and services to block any transaction involving them.
Analytics firms TRM Labs, Chainalysis and Elliptic had reached the same conclusion.
Pyongyang has rejected the accusation. Binance has not commented on the FBI’s attribution.
In the Bybit case, according to Safe, the wallet provider itself, the starting point was the computer of one of its developers.
This is the largest cryptocurrency theft ever recorded, more than four times the size of the Bybit hack. Elliptic says it is almost certainly the largest theft of any kind.
Does artificial intelligence play a role?
For now there is no evidence that AI was used in this attack, and the FBI’s notice makes no mention of it. Elliptic, which is tracking the stolen funds, says the laundering process is automated and follows a pattern typical of scripts written and monitored by people. It has seen no signs of an AI making autonomous decisions, though the data cannot rule it out.
Still, there is a notable piece of context. On the very day of the attack, Microsoft published a report on artificial intelligence used by North Korean groups.
Among the most advanced, it names Jade Sleet — the label under which the US cybersecurity agency tracks the group known as TraderTraitor.
One of the most significant uses highlighted is deceiving people, for example through fake recruiters contacting software developers.
The report does not mention Binance, and Binance has not explained how the engineer’s laptop was compromised. Microsoft notes that, ultimately, human operators remain in control of these operations.
If you have funds on Binance
Since Sunday 1 November, withdrawals have been reopening gradually, starting with bitcoin and the main cryptocurrencies.
The second phase began on Tuesday, but many smaller cryptocurrencies still cannot be withdrawn, and there is no date yet for a full reopening.
Binance says it has covered about 95% of the stolen funds with its own money and will not pass the losses on to customers.
The remaining 5%, it says, is in less common cryptocurrencies that are slower to repurchase.
On Monday, Binance published a proof-of-reserves snapshot dated 31 October. Anyone holding one of the ten cryptocurrencies chosen by the company can independently verify, using a public tool, that their balance is included in the count.
According to Binance, for those ten assets, total reserves cover at least all customer balances.
It’s a useful check, but it applies only to a specific moment in time and only to those ten assets — it is not an audit. It remains a company pledge, not a public guarantee.
For residents of Italy there is an additional factor. In the register of ESMA, the European markets authority, checked on 3 November, Binance does not appear among the authorized providers.
In June it withdrew its application filed in Greece and said it intended to pursue licensing in another EU country.
According to notices sent to customers, in Italy and other countries where it had local entities, from 1 July onward most customers were left mainly with the ability to withdraw funds.
Binance notes that restrictions vary by country, account status and the entity providing the service.
Following the attack, Binance has not issued specific guidance for European customers. It’s worth checking in the app which cryptocurrencies and networks are already available for withdrawal from your account.
Three rules apply to everyone. Don’t pay anyone to withdraw early or skip the queue: Binance warns that anyone offering this is a scammer. Don’t click on messages, fake refunds, or “proof of reserves” sites that don’t come from the official app. Test with a small amount first, checking the network and address, and only then move the rest.
Why this matters even for companies with no cryptocurrency exposure
Binance has not yet explained how the laptop was compromised, and what follows is not a reconstruction of its specific case. Strip away the cryptocurrency angle, and what remains is a question relevant to any business. If someone were to breach the computer of whoever manages your systems tomorrow, how many doors would still stand between them and your money?
An attack of this scale can hit even the largest platform in the industry. In smaller companies, there is often only one door. The outside IT contractor has used the same passwords for years. Online banking is accessed from the same computer used to check email. A single person, from their phone, authorizes wire transfers.
It’s unlikely your company will be the target of an attack on this scale. But the infected attachment and the email from a fake supplier with a changed IBAN are already arriving — and the question remains the same.
What to do, in practice
First: list who can do what. Who has access to the servers, the email, the management software, the banking systems. The list should also include outside contractors and anyone who no longer works with you. If the list doesn’t exist, start there.
Second: separate your computers. Sensitive operations should be carried out on a dedicated computer, separate from the one used for everyday tasks.
Third: never leave money decisions to a single person. Major wire transfers and IBAN changes should require sign-off from two people. If one person’s computer is compromised, the second is the last line of defence.
Fourth: spot it quickly. You need alerts for unusual logins and out-of-pattern transactions. If the bulk of Binance’s funds left in about 20 minutes, who in your company would notice — and after how many days?
A computer can always be breached. What you can control is what an intruder finds once inside, and how many doors remain for them to open.
If no one can tell you who holds the keys to your company, you’ve already found the first door that needs closing.
Article updated Tuesday 4 November with the reopening of withdrawals, the proof of reserves, and the FBI’s attribution.
Observatory Strategic.sm
——
If the list doesn’t exist, we’ll build it for you. Strategic is available to anyone who wants to find out who truly holds the keys to their company, close off unnecessary access, and secure their payments.
Just get in touch with us at strategic.sm.
