JUST ONE LAPTOP: Binance hack is history’s biggest crypto heist and another warning sign

The planet’s largest crypto exchange was hit for more than $6bn in a two-wave attack. Access to one laptop was all the attackers needed.

Dive Deeper

Speed Read

Summary

Listen

Sometimes you have to see the humour. @BadlyLiquidated won the banter award on X by posting “binance hacker was the only person to ever make money on eth” and, no shade to the Ethereum heads out there, but that is legitimately funny.

On 29 October 2026, the global financial ecosystem experienced the largest cryptocurrency breach in history.

But don’t worry, “user funds are safe,” were the comforting words Binance Africa shared with Daily Maverick in a statement confirming the incident.

“Binance has already reserved over $6.34-billion of company funds to cover this incident,” the company explained, “$5-billion of these funds are already held in the exact token assets that were impacted.”

Wait, what exactly happened?

The attackers walked through the front door: Binance’s master private keys were completely untouched. Instead, hackers infected a single DevOps engineer’s laptop. Using that access, they pretended to be a legitimate internal service authorised to send out automated withdrawals.

They worked at speed: Over a 20-minute window at 20.05pm the attackers drained roughly $6.3-billion across 10 different blockchains.

They used smart contract automation: On Ethereum, the hackers used pre-prepared instructions (EIP-7702) to instantly convert Binance hot wallets into automated “sweeper” contracts, auto-redirecting incoming and existing funds out in seconds.

Who did it? Blockchain intelligence firms (like TRM Labs and ZachXBT) attribute the attack to TraderTraitor – a state-sponsored North Korean group (Lazarus Group).

Wait, what exactly happened?

The attackers walked through the front door: Binance’s master private keys were completely untouched. Instead, hackers infected a single DevOps engineer’s laptop. Using that access, they pretended to be a legitimate internal service authorised to send out automated withdrawals.

They worked at speed: Over a 20-minute window at 20.05pm the attackers drained roughly $6.3-billion across 10 different blockchains.

They used smart contract automation: On Ethereum, the hackers used pre-prepared instructions (EIP-7702) to instantly convert Binance hot wallets into automated “sweeper” contracts, auto-redirecting incoming and existing funds out in seconds.

Who did it? Blockchain intelligence firms (like TRM Labs and ZachXBT) attribute the attack to TraderTraitor – a state-sponsored North Korean group (Lazarus Group).

And here’s the really clever bit… Usually, when stolen funds move into central stablecoins like Tether (USDT) or Circle (USDC), the companies blacklist those digital wallet addresses and freeze the cash. Tether froze $1.57-billion and Circle froze over $800-million.

Before issuers could freeze the wallets, the hacker deposited the stolen USDT into decentralised lending platform Aave as collateral and borrowed liquid Ethereum (ETH) against it.

Tether froze the USDT sitting inside Aave, but Tether cannot freeze native Ethereum so the hacker walked away with liquid, unfreezable ETH, leaving Aave holding millions in frozen USDT collateral.

A universal problem

Binance and government agencies have not formally confirmed attribution, but the tactics align directly with prior state-backed campaigns, including the February 2025 Bybit breach ($1.5-billion).

Crucially, this incident is a repeatable pattern. Just five weeks ago, on 24 September 2026, cryptocurrency exchange Bitget suffered a $388-million breach executed through identical methodology: leaving vault keys untouched while subverting the wallet control and transaction-signing layer.

“I’ve followed a lot of crypto thefts, and the Binance attack stands out less for the money, than for how it was done,” explained Hendrik de Bruin, head of security consulting for Africa at Check Point Software Technologies.

“The attackers didn’t break the encryption or steal the private keys. They took over the system that tells the keys what to sign. Binance’s early findings for now point to one compromised engineer’s laptop. From there, the attackers reached a service that could submit withdrawals, and billions moved within minutes. That’s the lesson: a strong vault doesn't matter if someone controls the process that opens it.”

“The attackers didn’t break the encryption or steal the private keys. They took over the system that tells the keys what to sign. Binance’s early findings for now point to one compromised engineer’s laptop. From there, the attackers reached a service that could submit withdrawals, and billions moved within minutes. That’s the lesson: a strong vault doesn't matter if someone controls the process that opens it.”

He added that this isn’t just a crypto problem – banks, cloud providers, and payment gateways face the exact same threat if a single admin device can trigger automated money movements without a second human checking it.

De Bruin advised enterprise CISOs to re-evaluate endpoint access controls for privileged personnel:

“Protect the people with the most access first. Treat developer and admin devices as high-value targets. Assume any machine or credential can be compromised, and make sure none of them can move large sums without an independent check. Set hard limits on how much and how fast funds can move, and catch anomalies in seconds, not hours. Prevention has to come first, because once money spreads across multiple blockchains, getting it back is the exception.”

“Protect the people with the most access first. Treat developer and admin devices as high-value targets. Assume any machine or credential can be compromised, and make sure none of them can move large sums without an independent check. Set hard limits on how much and how fast funds can move, and catch anomalies in seconds, not hours. Prevention has to come first, because once money spreads across multiple blockchains, getting it back is the exception.”

Tough time fighting cybercrime

This hack didn’t happen in a vacuum, in fact it coincided with one of the worst global patching weeks in years. Allan Juma, lead cybersecurity engineer at ESET, drew direct parallels between high-profile platform exploits and underlying web application vulnerabilities such as PHP2Shell.

 “Out of everything that was discovered and disclosed in October, PHP2Shell should serve as a warning to South African companies,” he says. “The two flaws – CVE-2026-109618 and CVE-2026-109619 – can allow attackers to execute code without logging in and put all PHP installations serving web requests at risk.”

And cybersecurity is becoming a bigger problem because threat intelligence data reveals an ever-narrowing window between vulnerability discovery and weaponised global exploitation.

“It’s becoming very hard to counter hacks as AI can find vulnerabilities faster than you can fix them,” Trace Finance CEO Bernardo Brites observed regarding AI-driven vulnerability exploitation. “My view is that users will move away from smaller and medium-sized exchanges, becoming too risky to park your money somewhere that couldn’t cover a hack of meaningful size.”

The Binance breach and the concurrent PHP2Shell global patching crisis shows that modern cyber risk is defined by speed, automation, and workflow subversion. The threat is coming from inside the organisation, and accelerated by AI. DM

Maverick News

Business Maverick

cryptocurrency theft

Lindsey Schutters

hack

crypto heist

Aave

one laptop

Lazarus Group

Ethereum

Binance