Signed, Sealed, Stolen: What the $6.3B Binance Heist Teaches OT About Trusted Systems

Amigos, I don’t usually write about crypto. This blog lives in plants, substations and water systems. But last week something happened that every OT defender should read about, because the lesson has nothing to do with Bitcoin.

On October 29, attackers drained Binance’s hot wallets. Binance puts the amount taken at about $6.3 billion in token assets. The FBI says “more than $6 billion.” TRM Labs and Elliptic both describe it as the largest crypto theft on record, about four times the roughly $1.5 billion Bybit theft in February 2025.

And here’s the part that made me stop scrolling: according to Binance, there’s no evidence the private keys leaked. The vault stayed locked. Somebody got the system that opens the vault to do it for them.

What actually happened

The timing is wild. Starting around 20:05 UTC (4:05 p.m. Eastern), wallets on about ten or eleven blockchains started emptying. TRM counts 10 chains and Elliptic counts 11. Most of the money moved in about 20 minutes.

Binance’s account so far, from its own updates on October 30: its initial investigation “suggests” a compromised DevOps engineer’s laptop gave an attacker access to “a service container” that submitted unauthorized withdrawal transactions. Hours later, Binance said investigators had “uncovered additional points of breach” and called it “a complex attack.” Co-CEO Richard Teng said it “was not carried out by one person” and that the attacker used “a self-destruct mechanism that destroyed tooling and traces.”

So, por favor, read the laptop as Binance’s starting point, not the final answer. There’s no root cause and no post-mortem yet. Binance has promised a post-incident report. Until it lands, how that laptop got compromised is unknown. No source says.

What the blockchain analysts can see is how the money left. The transactions carried valid signatures from Binance’s own wallets. Elliptic put it plainly: “rather than stealing Binance’s private keys, the attacker was able to get Binance’s own systems to sign transactions on their behalf.”

On Ethereum it was even sneakier. A single transaction carried 50 validly signed, pre-signed authorizations for one hot wallet. One of them took effect and handed control of that wallet to a contract the attacker had deployed. About $2.5 billion left in one transaction, per CoinDesk and Elliptic. Teng said that delegation “did not pass through our normal approval controls.” In other words, the request came in a shape the approval process wasn’t built to catch. And it stayed live for about 3 hours 50 minutes, sweeping new deposits several more times, before it was revoked.

On the other chains, the funds just left through ordinary signed transfers.

One more detail worth knowing. Binance says only its own hot wallets were hit, not customer funds. CoinDesk, though, reported that the compromised wallets had previously appeared in Binance’s list of reserve addresses backing customer balances. So “no customer funds were touched” is Binance’s description, and the line between company money and customer backing is blurrier than the headline suggests.

$6.3B taken is not $6.3B lost

Mira, this matters if you’re going to repeat the number. $6.3 billion is what was taken. It is not what customers lost.

As of November 2:

Elliptic has verified about $2.85 billion frozen on-chain, almost all of it stablecoins. Binance says about $3 billion.
Circle told CNBC it froze more than $1.1 billion in USDC, and Tether froze well over a billion in USDT, according to Elliptic and TRM.
Binance says it has replenished about 95% of the affected assets from its own funds, including its SAFU emergency fund, and says users “will not bear the financial impact.”

Those numbers are still moving. Recheck them before you quote them.

Who did it

On October 31, the FBI, with the US Secret Service and IRS Criminal Investigation, attributed the theft to North Korea’s TraderTraitor activity and published hundreds of laundering addresses for exchanges to block. Chainalysis, TRM and Elliptic had already pointed the same way from on-chain evidence.

Binance itself hasn’t named anyone. Per Reuters, Teng said on October 30 that the investigation had not yet identified the attackers.

You’ll also see “Lazarus” in a lot of headlines. That’s an umbrella industry name. The FBI’s label is TraderTraitor, so that’s what I’m using.

Why I’m writing about this on an OT blog

Let me be clear first: no source says any industrial control system was involved. This is an analogy. But it’s a really good one.

Your signers are your crown jewels. In a plant, the “signing infrastructure” is the engineering workstation, the PLC programming software, the firmware signing service and the remote access broker. Those are the systems allowed to change the process. Binance shows that protecting the key isn’t enough if the system that uses the key will sign whatever it’s handed. Same with a signed firmware chain or a locked-down PLC: if the engineering host that’s allowed to push logic is compromised, the controller does exactly what it’s told.

The DevOps laptop is your engineering laptop. Binance’s first suspect was a DevOps engineer’s machine. In the Bybit theft, per Safe and Mandiant’s preliminary findings, it was a Safe{Wallet} developer’s machine. In OT, it’s the engineering workstation or the integrator’s laptop holding project files, credentials and the power to change logic. Treat it like the most important computer in the building, because it is.

Standing access is a gift to attackers. That malicious delegation sat there for almost four hours and kept working. In OT, that’s the always-on vendor VPN session, the service account nobody rotates, the token that never expires. If you can’t revoke access everywhere in minutes, you’re leaving the porch light on and the key under the mat.

Supply chain reaches OT. This bridge to energy isn’t hypothetical. Mandiant traced the 2023 3CX compromise to a trojanized X_TRADER trading application, a cascading supply chain attack it tied to a suspected North Korea-nexus actor. Symantec then found that same trojanized X_TRADER at two critical infrastructure organizations in the energy sector, one in the US and one in Europe. Money-motivated operations don’t stay politely in finance.

One more lesson, and it’s a hopeful one: containment worked because relationships existed before the crisis. Elliptic says about 44% was frozen, compared with about 3% after Bybit. Issuers, analytics firms and law enforcement moved within the hour. In OT, that’s your vendor PSIRT, your ISAC, CISA and your FBI field office, with contact paths you’ve actually tested, claro.

Bottom line

Treat engineering workstations and DevOps laptops as Tier 0. Use dedicated hardware, keep email and browsing off them, and send their logs off-host in real time.
Control what your “signers” will approve. Show approvers the real payload, and don’t let a new kind of request slip past checks built for another kind.
Kill standing access. Use just-in-time vendor sessions and make sure you can revoke everything in minutes.

The cryptography held. The people and systems around it didn’t. That’s true in a plant too, familia. Stay sharp.

Javier