In short
Binance's preliminary account is that an attacker used one engineer's compromised laptop to submit withdrawals, and about $6.3bn left in roughly 20 minutes. A small business has the same weak point: the one or two people whose devices hold admin rights or payment approval. Give them separate admin accounts, do admin work from a dedicated device, require a second person to approve payments, and make sure a compromised laptop can be cut off within minutes.
On 29 October, attackers took about US$6.3 billion in crypto from Binance in roughly 20 minutes. Binance's first explanation was that the breach "may involve a compromised DevOps engineer's laptop". Your business holds no crypto, but it almost certainly has a laptop like that one: a device whose owner can change your systems or move your money.
What happened at Binance, in two paragraphs
The theft began on the afternoon of 29 October, US Eastern time, and most of the funds left within about 20 minutes, according to the blockchain analysis summarised on Wikipedia. It is the largest crypto theft on record, well ahead of the $1.5 billion taken from Bybit in 2025. Around $3 billion in stablecoins has since been frozen by their issuers, and Binance says it will cover customer losses from its own funds.
Binance said the laptop gave the attacker a way to submit withdrawals nobody had authorised, as reported by Business Insider. It has since said it found "additional points of breach" in what it calls a "complex attack", and it has promised a technical postmortem. The FBI has attributed the theft to TraderTraitor, a North Korean group. So treat the laptop as Binance's early account rather than the final word. The lesson for a small business holds either way.
One laptop, and every key it carried
An engineer's laptop at an exchange is a privileged device. Whoever controls it can do what its owner can do. The attacker did not need to break into the vault from outside. They needed the person who already held a key.
In a 20-person business, fewer people hold more keys. Typically:
- the practice or office manager, who holds global admin rights in Microsoft 365
- the bookkeeper, who can release supplier payments from online banking
- the director, whose mailbox approves both
It comes up in most of our onboardings: the most powerful account in the business belongs to someone who also reads every email, opens every attachment and browses the web on the same machine. That is the position the Binance engineer was in, at a far larger scale.
Twenty minutes is faster than anyone can read an alert
The attacker likely prepared for at least 36 hours, then moved fast. Patience followed by speed beats any business that relies on a person noticing something odd.
The timeline shows how hard containment is even for a well-resourced firm. Stablecoin issuers began freezing wallets within the first hour. The attacker's permissions on Binance's hot wallet were removed at 8:10 p.m. ET, roughly four hours after the first transfer, according to the timeline compiled on Wikipedia.
For a small business, the lesson is to decide in advance what happens automatically. Endpoint detection and response (EDR, software that watches each device for signs of compromise) can isolate a laptop from the network the moment it misbehaves, without waiting for anyone to read an alert. The account matters as much as the device: revoke its active sessions, because a password reset alone leaves an attacker's session working. We set out that order of work in spotting a hijacked mailbox early.
Keep the accounts that move money or change systems apart
The aim is that one compromised laptop, or one phished inbox, is not enough on its own.
Separate admin accounts
Nobody should do admin work from the account they use for email. Give each person who needs admin rights a second account, used only for admin, with no mailbox and with phishing-resistant sign-in such as a FIDO2 security key. If their everyday account is phished, the attacker gets an inbox rather than your whole Microsoft 365 tenant. Which conditional access controls you can apply to those accounts depends on the Microsoft licences you hold, so confirm that before you plan around it.
A dedicated device for admin work
Microsoft calls this a privileged access workstation: a locked-down machine used only for admin, with no email and no general browsing. At small-business scale it does not need to be a formal programme. A separate managed laptop, kept for the handful of admin tasks done each month, removes the most common route from a phishing email to full control.
Two-person approval for payments
Business banking platforms commonly offer dual authorisation, where a second person must approve new payees or payments above a set amount. Ask your bank what yours supports and switch it on. A compromised laptop then gets an attacker as far as a pending payment, and a second person has to look at it before any money moves.
If your business falls under NIS2, or supplies one that does, Article 21(2)(i) of the NIS2 Directive lists access control policies and asset management among the security measures expected. Separating admin accounts and devices is a practical way to show you have done that.
Five things to check this week
- List everyone with global admin rights in Microsoft 365, and everyone who can release payments in your banking platform. If either list runs past two or three names, ask why.
- Check whether those people use the same account for admin work and for email.
- Confirm that admin sign-ins use a security key or passkey, not a text message code.
- Ask your bank whether dual approval is on for new payees and for large payments.
- Ask whoever manages your IT: if the office manager's laptop were compromised at 4 p.m. on a Friday, what would cut it off, and how long would that take?
Where to start
Start with the first item. It takes an hour, and it tells you how many laptops in your business carry the keys. Firms in accountancy and legal practice carry more weight here, because an admin account in those trades reaches client money and client records at the same time.
If you want a second pair of eyes on your admin accounts and devices, that work sits inside our managed IT service. Our penetration testing will show what an attacker could reach from one compromised laptop in your business. Get in touch and we will start with the accounts that would hurt most.
How did the hackers get into Binance?
Binance's preliminary explanation was that an attacker used a DevOps engineer's compromised laptop to submit unauthorised withdrawals. It later said it had found additional points of breach in what it called a complex attack, and it has promised a technical postmortem. The FBI has attributed the theft to TraderTraitor, a North Korean group. The full route in is not yet public.
Could the same kind of attack happen to a small business?
Yes, at a smaller scale. Any business where one person's laptop can change systems or release payments has the same weak point. Attackers target the person who already holds access rather than breaking in some other way. Separate admin accounts, phishing-resistant sign-in and two-person payment approval mean one compromised device is not enough on its own.
Should the person who manages our IT use a separate admin account?
Yes. Admin work should happen from an account used only for that purpose, with no mailbox and with phishing-resistant sign-in such as a security key. Email is where most attacks start, so keeping admin rights off the everyday account means a phished inbox does not hand an attacker control of your whole Microsoft 365 tenant.
What is a privileged access workstation, and does an SMB need one?
It is a locked-down device used only for admin tasks, with no email and no general browsing. Large organisations issue one to every administrator. A small business rarely needs a formal programme, but a separate managed laptop for the few admin tasks done each month removes the most common route from a phishing email to full control.
How quickly should a compromised laptop be cut off from the network?
Within minutes, which in practice means automatically. The Binance theft took about 20 minutes, faster than any person can read and act on an alert. Endpoint detection and response software can isolate a device as soon as it behaves suspiciously, and revoking the user's active sessions stops the account being used from anywhere else.