The Blockchain Didn’t Fail, Access Did

By Marta Ambor

This Thursday, October 29, Binance suffered the largest theft in the history of crypto assets: around $6.3 billion, more than four times what was taken from Bybit in February 2025. And I confess that what unsettled me most was not the figure, but how it happened.

To understand it, it’s worth knowing how an exchange stores money. I like to explain it with a simple example. Most of the funds sit in cold wallets, disconnected from the internet: the digital equivalent of a buried safe. But a platform that moves billions a day needs to pay out instantly, and for that it uses hot wallets, connected to the network, with systems that sign withdrawals automatically.

The safe held up. The attacker didn’t touch it. According to Binance’s account, they got in through an engineer’s laptop, jumped from there to an internal service and ordered withdrawals that no one had authorized. The company maintains that no private key was leaked. The analytics firm TRM Labs points to something more serious: that the machine responsible for signing was simply obeying whatever the attacker asked of it.

In about twenty minutes, the funds were moved out, spread across ten blockchains. TRM Labs attributes the attack, with high confidence, to TraderTraitor, a group linked to North Korea. Binance has not yet confirmed this.

But it wasn’t all bad news, and I think it’s only fair to say so. Around $2.54 billion was frozen. Binance has also committed to covering all of its users’ losses.

The market, as expected, took the hit. Bitcoin fell below $77,000, nearly $1.5 billion in leveraged positions were liquidated, and withdrawals on the platform remain paused as I write these lines.

Not an isolated case, but a pattern

Most revealing is what it has in common with other incidents from these same days. Polymarket had around $2.7 million stolen through a script from an external provider. In Japan, another company in the sector is facing a $50 million ransom demand.

No one has broken the cryptography. Not at Binance, not at Polymarket, not in Japan. The attackers got in through one person’s laptop or through a third party’s code. The weak link is not blockchain technology, which keeps doing exactly what it promises. The weak link is access: who can touch what, from where and with what controls.

For years, the debate over crypto asset security has focused on whether the technology was reliable. Today the question is different: are organizations properly governing access to that technology? Unlimited automatic signing, internal services that blindly trust one another and providers with more permissions than necessary are open doors, no matter how solid the safe may be.

Your laptop is a door too

And here I ask you to keep reading, even if you’ve never bought a cryptocurrency, because the lesson goes far beyond the sector. More and more professionals are connecting artificial intelligence agents, extensions and connectors to their email, their documents and their work tools. They are useful, no doubt. But each one of them is a new door. If an attacker can reach your systems through your laptop, they can also do so through a tool you granted permissions to without thinking twice.

Before installing any application or granting any access, I suggest asking yourself a simple question: what can this touch? And then, periodically reviewing those permissions, just as we check who has the keys to our house.

The technology didn’t fail. People and permissions did. And that, unlike cryptography, is up to us.