How $6 billion was stolen from Binance in twenty minutes— the largest theft ever, where nobody broke anything

On the evening of 29 October, money started leaving Binance. Not through one door, but through ten or eleven at once, on different networks, in payments that looked entirely normal. Twenty minutes later, more than $6 billion was gone. On 31 October, the FBI said North Korea did it.

It is the largest theft in the history of the internet. But the number is not the interesting part, and neither is the fact that it happened to a crypto exchange.

Here is the interesting part: nobody broke anything. No code was cracked. No lock was picked. The attackers got Binance's own systems to hand over the money, and every single payment they sent out was completely valid.

The machine that signs the cheques

An exchange like Binance cannot have a person approve every payment. The volume is far too high. So approval is handed to software: a system that holds the keys and signs off on payments automatically, thousands of times a day.

Think of it as a machine that signs cheques. It lives in a locked room. The signature it produces is genuine, and the bank honours it without question, because that is the whole point.

The attackers did not forge the signature or steal the machine. They got into the room, and then they simply asked it to sign.

That is why the theft looked so unremarkable while it was happening. The money left in ordinary payments on most of the networks involved. On one, Elliptic found a single instruction carrying fifty separate approvals, all correctly signed. Nothing about any of it was invalid. The bank, so to speak, had no reason to refuse.

How did they get into the room? Binance has pointed to a compromised laptop belonging to one of its engineers, and has since said it found other ways in that it has not described. The investigation is still open. But the broad shape is depressingly ordinary: get onto a developer's machine, follow the path to the system that approves payments, and ask.

The same thing happened in 2025

The exchange Bybit lost around $1.5 billion to the same North Korean group last year. The method was the same in every way that counts. The people who approved that payment thought they were approving something else. As Elliptic put it, what was compromised was "the infrastructure and people around the wallets, not the cryptography."

The industry's response was to buy better locks. Stronger key storage, more approvers, tighter ceremony around the keys themselves.

All sensible. All aimed at the wrong thing, because the keys were never what failed.

The Binance theft is roughly four times the size of Bybit's. Same group, same approach, bigger target, better result. That is not a story about defenders being careless. It is a story about everyone spending a year fixing the part that was already working.

You probably have one of these machines

This is where it stops being a crypto story.

Most organisations of any size have handed some authority to software, because the volume made it necessary and the software is reliable. A build system that signs your product before it reaches customers, so their computers trust it automatically. A finance integration that releases payments to suppliers. A deployment system that can change what is running in production without anyone clicking approve.

Each of those is a machine in a locked room. Each one produces something the rest of the business accepts without argument, which is exactly why it was built. And in each case, whoever reaches the machine inherits everything it can do, without ever needing to break the lock.

So the question to take away is not about Binance, and it is not really about crypto.

Fifty approvals went out in one instruction, and nothing stopped them. In your organisation, what would have? Not what would have recorded it afterwards, because the records here were fine and the money still left. What would have refused it, somewhere the attacker could not also reach?

If the answer is a person who would have noticed something odd, ask how many such payments or deployments go past that person in a week, and whether anyone could reasonably spot the wrong one. If the answer is a limit set inside the system itself, remember that the attacker now controls that system.

None of this requires new technology to fix. It mostly requires asking which of your machines nobody has looked at in a while, and who can get into the room.

The key takeaway

The strongest lock in the world protects nothing if the thing behind it will do as it is told. Binance's keys were never broken, and neither were Bybit's. In both cases the attackers reached the system that was trusted to approve payments and used it exactly as it was designed to be used. Wherever your organisation has handed approval to software, whether that is releasing software, paying suppliers or changing production, the question worth asking is no longer whether the keys are safe. It is who can get to the machine that uses them.