On October 29, roughly $6.3 billion was drained from Binance wallets across ten blockchains, most of it within about twenty minutes. It is the largest theft of its kind on record, dwarfing the $1.5 billion taken from Bybit in early 2025. Binance halted withdrawals, said it would reimburse losses, and reportedly froze around $3 billion with blockchain partners.
You can skip the cryptocurrency entirely and the story still matters, because of how it started. Binance's initial investigation points to a compromised laptop belonging to a DevOps engineer, which let an attacker reach a service container and submit unauthorized withdrawals. The company said it found no evidence of a wallet private key leak, and has since said a further probe found additional points of breach.
What is established and what is not
Worth separating, because the attribution is moving faster than the facts. Blockchain intelligence firms TRM Labs, Chainalysis and Elliptic have each attributed the theft to North Korea with high confidence, TRM naming the group it calls TraderTraitor. Binance has not confirmed that attribution. The laptop is Binance's own initial finding, not a final account, and the company has signalled the full chain of access is not yet public. Nobody outside the investigation knows how the engineer's machine was compromised.
Why a small business should read this
Because of the shape of it. The largest exchange in the world, with a security budget a small business cannot imagine, and the first domino was an endpoint. Not a clever cryptographic break, not a stolen private key. A laptop.
That pattern is the norm rather than the exception, and it scales down perfectly. Your laptops are your perimeter. The distance between one compromised device and the system that moves your money is the number that actually describes your risk, and most small businesses have never measured it. In a lot of them the honest answer is zero steps: the same machine that reads email also has a browser session logged into online banking, and the person using it has local administrator rights.
Two uncomfortable follow-ons. The more technical the user, the more access their machine has, which inverts the usual assumption that senior or technical staff need less protection. And the compromise of a device is rarely noticed by the person using it; it is noticed later, by what happens next.
What to actually do
- Count the steps from any one laptop to your money. If a single machine can reach your banking, payroll and the approval for both, that is the finding, and it is fixable.
- Separate the money. Payment approval should require a second person or a second device. This is the control that would have mattered most here, and it is free.
- Take away local administrator rights for day-to-day accounts, including the technical ones. Most device compromises get much worse at the point the user was already an admin.
- Treat your most technical staff as the highest-value targets, not the ones who can be trusted to skip the controls.
- Make sure devices are actually managed: patched, encrypted, with endpoint protection you could confirm is running right now rather than assume. That is what endpoint management is for.
- Know what a device can reach. Saved browser sessions, stored API keys, SSH keys, cached credentials. The laptop's blast radius is the sum of what it is still logged into.
- Reduce standing access. Admin rights, banking sessions and production keys do not need to be permanently available on a working machine.
The takeaway
A $6.3 billion loss that reportedly began on one employee's computer is the clearest available argument that endpoint hygiene is not a junior concern. For a small business the actionable version is a single question: how many steps separate any one of your laptops from the thing that moves money? If the answer is none, that is this week's work, and it costs almost nothing to change.