The $6.3 billion lesson: what every organisation can learn from the Binance hack

Summary

• Prevention will eventually fail, so organisations should design their cybersecurity around resilience: limiting the damage of a breach and recovering quickly
• The Binance attack, in which about $6.34 billion was taken from hot wallets, was a patient months-long operation that began with a tampered Homebrew package and fake job-hunting contacts targeting engineers
• Treat identity as your main perimeter by giving privileged access to the fewest people for the shortest time, and move towards just-in-time credentials that expire within minutes or hours
• Govern AI tools as non-human identities with minimal access, their own credentials and human approval for sensitive actions, and provide a verified internal repository of approved software packages
• Ask how far one compromised identity could reach, how quickly access can be revoked, and whether you have rehearsed recovery with your key partners

When cybercriminals stole more than $6 billion from cryptocurrency exchange Binance in what analysts have described as the largest crypto theft ever recorded, the story was about far more than digital assets. The attack did not begin with a direct assault on technical defences.

Instead, it unfolded through manipulated software, social engineering and the compromise of trusted identities. For business leaders, the incident offers a powerful reminder that cybersecurity is no longer just about protecting systems. It is about controlling access, limiting trust and ensuring organisations can recover quickly when preventative measures fail. In this article, we explore what happened, why it matters and the practical lessons every board and IT leader should take away.

Who is Binance, why are they important and what happened?

Binance is one of the world’s largest cryptocurrency exchanges: a giant digital vault that millions of people trust with their money. On 29 October, attackers moved about $6.34 billion out of its hot wallets, which blockchain analysts at TRM Labs called the largest crypto theft on record. This wasn’t a smash-and-grab. It was a slow, patient heist over months, and one chapter began with a job interview. For any board, the lesson is concentration risk: when so much value sits behind a single signing process, protecting who and what can authorise a transaction matters as much as protecting the vault itself. Around $2.85 billion has since been frozen or intercepted, and Binance says it will absorb the loss rather than its customers.

Why treat the theft of an org chart as being as dangerous as stolen passwords?

To be clear, there’s no public evidence that an org chart was stolen. Binance says that, even after the June compromise was contained, the engineer’s role and wallet-team colleagues remained exposed to the attackers. In other words, they knew who to look for. If passwords are the keys, an org chart is the map showing whose pocket the keys are in. That’s why identity and access management is now the real perimeter. Know exactly who holds privileged access, give it to the fewest people for the shortest time, review it regularly, and watch those identities more closely than anyone else’s. Remember, too, that a contained incident can still leave the attacker wiser.

How can companies enforce approved software sources for developers?

Binance says the June compromise came from a tampered Homebrew package, installed after the engineer searched for a popular AI coding tool. Downloading tools from the open internet is like buying medicine from a market stall. It’s probably fine, until it isn’t. This is software supply chain security, and the answer is to make the safe road the easiest road. Run an internal repository of approved, verified packages, route Homebrew, pip and npm through it, block direct downloads on work devices, and give developers a fast way to request new tools. If approval takes weeks, people will find a shortcut.

Why stop issuing permanent keys and switch to temporary access?

A credential that never expires is like leaving a spare key under the doormat, forever. The fix is zero standing privilege: credentials issued only when needed, tied to the person and the device, and expiring in minutes or hours, so a stolen one has the shelf life of fresh milk. Just-in-time access takes this further. Even the route to sensitive systems should work like a drawbridge, lowering when there’s a genuine need and rising again the moment the job is done. Binance hasn’t said whether the deployment token found on the engineer’s laptop was permanent, but the principle stands either way.

What part did social engineering play? Was there a take-home coding test?

A second engineer was approached on a legitimate job-hunting platform by someone posing as a project director. A friendly video interview with a supposed HR representative followed, then a second round on a chat app with the “CEO” of a company that didn’t exist. Finally came the request: download an assignment containing a malicious code repository, onto a work computer. 

For you

Be part of something bigger, join BCS, The Chartered Institute for IT.

It didn’t target a weakness; it targeted ambition. And because job hunting is private, the engineer’s own security team never got the chance to help. That’s why human risk belongs on the risk register, with training based on real attack scenarios and a no-blame way to ask, ‘Is this genuine?’

Are hackers trying to get hired as remote developers? How should companies verify identity?

Yes, and it’s the same trick in reverse: instead of a fake employer luring a real engineer, a fake engineer applies to a real employer. Security agencies have warned for some time that some ‘remote developers’ aren’t who they claim to be, and Binance says it has blocked dozens of suspected threat cases this year. Hiring is now part of security. Build identity checks into the joiner process: live video with ID verification, proper reference checks, and equipment shipped only to a verified address. Then grant access gradually. Trust is earned, and access should be too.

What limits should apply to internal AI tools?

Binance says the attacker used an internal AI tool as a springboard to gain control of two engineers’ machines. Here’s the uncomfortable truth: we’ve handed AI assistants the keys to the building and treated them like interns. They’re non-human identities, and they need the same governance as any privileged account. Give them only the access they need and their own credentials, require a human ‘yes’ before they act on other machines or change permissions, and log everything they do. AI can be a brilliant colleague. It just shouldn’t be an unsupervised one.

How can companies separate developer workspaces from the core network?

Developers need horsepower, but their laptops shouldn’t be one step away from the crown jewels. That’s the heart of zero trust: no device is trusted just because it’s on the inside. Use privileged access workstations or virtual desktops for production, run untrusted code in disposable sandboxes where it can explode without taking the house with it, and make sure deployments and transaction signing flow through a controlled pipeline with separation of duties, never straight from a laptop. Binance says it is tightening device controls and investing in developer-environment security.

How can IT design systems that assume employees will eventually be tricked?

Let’s be honest: we’re human. We click, we trust, and we dream about the next big role. So design for ‘assume breach’. Pick any laptop and ask: if this were compromised today, what’s the most an attacker could do? Then shrink that blast radius with least privilege, short-lived credentials and two-person approval for high-value actions. Add behavioural monitoring that spots unusual activity even when malware slips past antivirus, as it did here, and measure how fast you detect and contain it. And make it safe to speak up: a staff member who flags a suspicious recruiter is an early warning, not a problem.

What’s the single biggest lesson?

We don’t do security for permanence. We do it for resilience. Binance’s team caught the June compromise and still suffered a record theft four months later. Prevention will eventually fail. That isn’t defeatism, it’s realism. The questions boards should be asking are: how far can one compromised identity reach, how quickly can we revoke access, and have we rehearsed recovery with the partners we’d need? Binance and its partners froze or intercepted around $2.85 billion within days. That’s not a happy ending, but it’s a far better chapter than it could have been.

Subramani Rao FBCS CISSP is an award-winning cybersecurity leader, strategist and author, winning the GTIA Cybersecurity Leadership Award in 2026. Subramani’s SANS Institute white paper on DDoS attacks and mitigation has been cited by researchers worldwide. He holds an Executive MBA from London Business School and an MSc in Computer Security with Distinction, and speaks, mentors and advises on how organisations can move beyond prevention to build resilience across increasingly interconnected IT, OT and AI-driven environments.