Binance hack explained: Why stopping every breach no longer enough?

How the attackers got in, according to Binance

Binance’s initial investigation points to a compromised laptop belonging to a DevOps engineer. That access allowed the attacker to reach a service container and submit unauthorised withdrawal transactions.

• Suspended withdrawals while it overhauls the withdrawal service and related addresses
• Revoked the affected address authorisation
• Brought in law enforcement and blockchain intelligence partners to trace and recover funds
• Promised an updated Proof of Reserves once remediation is complete

Who might be behind it

Georgy Kucherin, a senior security researcher at Kaspersky GReAT, says an operation of this size would be hard to pull off, so state-backed groups cannot be ruled out. Early reports have mentioned several actors, including the Lazarus group, which has a long record of financially motivated attacks. Examples include the attempted $1 billion theft from Bangladesh’s central bank in 2016 and the roughly $1.5 billion Bybit compromise in 2025. Kucherin stresses that Lazarus’s involvement is still under examination and no final conclusion can be drawn yet.

Why employees are the weak link

Kaspersky notes that technical staff at crypto firms are frequent targets, and even experienced engineers can unknowingly download malware. It cited a case where a crypto developer installed a malicious extension for a development tool and lost USD 500,000. It also pointed to a separate incident the day before, on October 29, when Polymarket users were hit through a compromised third-party monitoring script on its website. The two cases show different attack routes: an internal workstation in one, an outside web component in the other.

1. Attackers are exploiting trust, not just breaking in. They increasingly turn legitimate access and transaction processes into tools for moving money.
2. Complexity creates new openings. Decades of security investment have strengthened traditional defences, but digital banking and AI have added new vulnerabilities.
3. Concern is rising. In GlobalData’s Wealth Management Industry Conditions Analytics 2026, 65% of surveyed firms named cybersecurity as their greatest threat, up from 56% in 2025. The survey covered 478 companies across 20 markets in Q2 2026. She says similar attitudes are likely in retail banking and payments.
4. Attackers need only one trusted pathway. They don’t have to defeat every control, and once inside, the speed of modern transactions leaves little time to step in.
5. Prevention alone is no longer the test. Institutions should assume some defences will eventually fail and design operations so one compromise cannot become a financial catastrophe.

What this means in practice

For financial institutions, resilience means more than strong perimeter security. It includes limits and approval checks on large transfers, monitoring that flags unusual transaction behaviour quickly, the ability to freeze or reverse movements fast, and tighter control over privileged employee access. Kaspersky’s advice for individuals and companies is to run security software on both personal and work devices.

What remains unclear

The attack route is still preliminary, attribution is unconfirmed, and the final loss figure and recovery amount may change. Binance’s promised post-mortem should settle many of these questions.