Binance $6.3B breach began on one engineer's laptop

Attackers stole at least $6.3 billion in crypto from Binance, TechCrunch reports, citing security researchers who call it the largest known crypto theft. The detail that matters for every business, crypto or not: Binance says the Binance breach started with one engineer's compromised laptop. That laptop led to a service that could submit withdrawals. You do not hold billions. You probably do have one laptop that can issue refunds, change payout bank details or push to production.

What actually happened

Per TechCrunch's reporting and Binance's statements:

• Entry point. Binance said a "compromised" engineer's laptop "allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions." How the laptop was compromised is not yet public.
• Keys not leaked, per Binance. The exchange says it has seen no evidence its private keys leaked.
• Partial freeze. A Binance spokesperson said about $3 billion has been frozen by industry partners and recovery has begun.
• Platform paused. Binance suspended all deposits and withdrawals during the investigation. It says user funds are safe and will publish updated proof of reserves after remediation.
• Attribution. Blockchain analytics firms TRM Labs and Elliptic both attribute the theft to North Korean hackers. TRM links it to the group known as TraderTraitor, also blamed for the $1.4 billion Bybit theft in 2025, and says the theft took about 20 minutes.

The figures may change. TechCrunch notes the incident is not confirmed resolved.

Why the Binance breach matters for your business

Trace the path from a laptop to your money. The question TechCrunch raises — why one employee device could reach systems that control billions — applies at every size. Sit down and list what one staff laptop can reach: the Stripe dashboard, the Shopify admin, the bank portal, the deploy pipeline, the cloud console. Any path that ends in "move money" with no second person in it is your exposure.

Stolen sessions skip the password. TechCrunch notes that malware on employee devices often steals passwords and session tokens, which lets an attacker log in as the employee. MFA at login does not stop a stolen session. Use short session lifetimes for admin tools and require a fresh check for high-risk actions.

Two people for money moves. Payout changes, large refunds and new bank accounts should need a second approval that happens on a different device. Most payment platforms and banks support this. Turn it on.

Production credentials don't live on laptops. Deploy and signing keys belong in your CI system or a secrets manager with scoped, short-lived tokens — not in a developer's shell history.

Sources: TechCrunch.