On October 29, 2026, approximately US$6.36 billion left Binance wallets, with most of the transfers occurring within roughly 20 minutes, according to TRM Labs. The intelligence firm classifies the incident as the largest cryptocurrency theft ever recorded. An initial Binance hypothesis involves a DevOps engineer's laptop; the investigation is ongoing.
The amount is staggering. But the amount is not the point.
Binance is the world's largest cryptocurrency exchange, both by holdings and trading volume. It has one of the best security operations on the planet. Yet it was breached in a way our threat intelligence team has seen repeated at Brazilian banks in recent weeks.
What this attack reveals is not a problem limited to the cryptocurrency market. It is a problem for everyone with a digital environment who thinks a 2025 security strategy still works in 2026.
What is known so far
The investigation is ongoing, and details may change. But what Binance and blockchain intelligence firms have disclosed already shows the scale of the case.
- Volume: approximately US$6.36 billion transferred from Binance wallets across ten different blockchains, according to TRM Labs. More than four times the US$1.5 billion Bybit theft in February 2025.
- Entry point: Binance said its initial investigation points to a possible compromise of a DevOps engineer's laptop, which may have enabled access to a service environment and the submission of unauthorized transactions. The company said it found no evidence of leaked private keys and later reported identifying additional points of compromise. The investigation continues.
- Attribution: TRM Labs and Chainalysis point to TraderTraitor, a group linked to North Korea and responsible for the Bybit case. Binance has not yet confirmed this.
- Response: about US$3 billion frozen, withdrawals suspended, and a commitment to cover losses with its own funds (Euronews).
An aside worth making: Binance was founded by Changpeng Zhao, who was born in China but moved to Canada at a young age. The company has neither headquarters nor a registered legal entity in China. It is more of a Western exchange than anything else. Anyone trying to explain the attack through Chinese geopolitics is looking in the wrong place.
What matters here is the profile of the person compromised. A DevOps or infrastructure engineer has more than access. They have context: they know how the exchange's systems operate, where the automations are, and how transactions are submitted. That is the crux of the issue.
October Storm: why October saw so many incidents
Binance is not an isolated case. October 2026 saw a concentration of cyber incidents that the international press has already dubbed Black October. Here at Vultus, we call it October Storm.
My interpretation is straightforward: this results from adversaries adopting artificial intelligence. Attackers have gained power and scale unprecedented in the history of digital security.
And this is a unique moment because pressure is coming from two directions at once.
On the business side, the attack surface has exploded. AI accelerated code development, with or without vibe coding, and the creation of entire infrastructures. Companies publish more services, integrate more platforms, and automate more processes than ever. A larger surface means more opportunity for attackers.
On the adversarial side, the same AI has made them far more capable. It is not that there are more attackers. It is that each attacker can now produce much more, much faster.
Combine both paths, and the result is October 2026.
This is already happening in Brazil
In the final weeks of October, Vultus's threat intelligence team tracked breaches at Brazilian banks and payment institutions with an attack chain very similar to Binance's. I am not saying it is the same group. I am saying it follows the same logic.
In cases monitored by Vultus, the starting point was legitimate initial access: the real credentials of a real user the organization trusts. This access can arrive through three paths.
Social engineering and workstation compromise. The victim is tricked into installing malware or providing access. Their laptop becomes the starting point for the rest of the environment. An initial Binance hypothesis involves a compromised laptop, but the investigation is still ongoing.
Software supply chain compromise. Every piece of software running in your environment, including on developers' machines, uses public libraries. Threat actors have been compromising these libraries, often through social engineering against their maintainers. When legitimate software updates and pulls from a poisoned repository, it is compromised as well.
SIM swapping against corporate phone lines. This was the pattern in the Brazilian cases. The SIM is registered to the company. Fraudsters approach the carrier with company documents, impersonate an authorized person, and transfer ownership of the line. From then on, they control the authentication factor and account recovery.
Social engineering and the supply chain are currently the two main initial access routes we observe. SIM swapping is causing the most damage in Brazil.
What changed: time is no longer on our side
What the Brazilian cases and the Binance case have in common is more than initial access. It is what happens afterward.
Until recently, and I mean eight or nine months ago, gaining access was only the beginning of an intruder's work. They needed to understand the environment: read documentation, map systems, discover how transactions were submitted, and find the path to the money. In payment infrastructures, this took days or weeks.
That time was our advantage. Usually, by the time attackers had learned enough to make transactions, the attack had already been detected and mitigated.
With AI, that changes. Once inside, attackers use AI to read code, documentation, configurations, and integrations, gaining in minutes the knowledge that once took weeks. AI navigates these infrastructures at a speed the world's best defenses cannot match.
Regarding Binance specifically, there is no public confirmation that AI was used in the operation. Most of the billions were moved in about 20 minutes, but this alone does not prove AI use or the method of access. TRM Labs identified signs of preparation before the transfers. In the cases we analyzed in Brazil, we observed a pattern of accelerated learning.
The challenge is no longer preventing the attacker from getting in. It is detecting and stopping their progress before they cause an impact. And the window to do so has shrunk dramatically.
Why Binance, and why it is your problem
Institutions that transact money have always been priority targets. What changed is crime's business model.
In the traditional model, attackers broke in, stole data, and needed a second step to monetize it: extortion, ransomware, or selling information. When the target can transact directly, whether in cryptocurrency or traditional money, that second step disappears. The intrusion becomes revenue immediately.
That is why banks, payment institutions, and brokerages are targets. It does not have to involve crypto.
Binance has characteristics that make it an attractive target: a large concentration of crypto assets and the ability to move them quickly around the world, creating unique tracking and freezing challenges. It is potentially one of the most frequently attacked companies in the world and has security to match.
Even so, it suffered an incident affecting billions of dollars in assets.
The immediate effect is distrust in the crypto market, and prices will fluctuate over the coming days. But another effect interests me. This attack calls every digital security strategy in use today into question.
If Binance was breached this way, how are other companies faring? How does your company look through AI's eyes?
The question every CISO must ask today
It is not "Are we protected?" That question has no useful answer.
The question is: what does our digital infrastructure look like to AI today? What does it see, and how far can it get, starting from three points:
- From the internet, without any access. What can be discovered and exploited on our external surface, which has grown much faster than our inventory of it.
- From legitimate low-privilege access. The credentials of an employee, an intern, or a vendor. Which systems they can reach and where they can escalate.
- From legitimate high-privilege access. A DevOps engineer's laptop, an administrator's session. The Binance scenario. Which critical actions can be performed without any additional validation.
The third scenario is the one almost nobody tests. Many companies regularly conduct external pentests but have never assessed what happens when a privileged identity is compromised. In this scenario, isolated access can lead to a high-impact incident.
And the answer does not come from a compliance questionnaire or a scanner. A scanner says a vulnerability exists. An audit says a control exists. Neither tells you how far an adversary can get by combining weaknesses in a real environment at AI speed.
You have to test. You have to use AI to test your environment continuously, the way adversaries already do. This is the direction Vultus has been pursuing: our offensive security specialists combined with autonomous AI testing, such as Ares, to find and validate real compromise paths as frequently as fast-changing environments require. This does not replace people. It gives them the same scale attackers have gained.
What the Binance attack really teaches us
The investigation will yield more details in the coming weeks. But the lesson does not depend on it.
A company's security is not measured by how hard it is to get in. It is measured by how far someone gets after entering, and how quickly. Adversaries do not follow our testing calendar, limit themselves to the audit scope, or wait for the next maintenance window.
It looks for paths. Combines weaknesses. Uses legitimate access. And now it does all of this with AI.
The bad news is that the adversary is ahead of us. The good news is that the same technology that gave them scale is available to us. The difference lies in who starts using it first.
Frequently asked questions about the Binance attack
What happened to Binance in October 2026? On October 29, 2026, approximately US$6.36 billion was transferred without authorization from Binance wallets across ten blockchains, with most of the transfers concentrated in around 20 minutes. It is the largest cryptocurrency theft ever recorded.
Who was responsible? TRM Labs and Chainalysis attribute the attack to TraderTraitor, a group linked to North Korea and also implicated in the Bybit case. Binance has not yet confirmed the attribution.
How did the intruders get in? Binance's initial investigation pointed to the possible compromise of a DevOps engineer's laptop and access to a services environment. The company later reported identifying additional points of compromise; the investigation remains ongoing. Binance said it had found no evidence of private keys being leaked.
Did the attack use artificial intelligence? There is no public confirmation of AI use in the Binance case, and the speed of the transfers alone does not demonstrate its use. In recent attacks analyzed by Vultus at Brazilian institutions, we observed a pattern of accelerated learning about the environment after access was gained.
How can I tell whether my company could suffer a similar attack? By testing. Continuously using AI to assess the environment from the internet, from ordinary legitimate access, and from privileged access, and measuring how far it gets.
Rodrigo Gava is CTO and Board Member at Vultus Cybersecurity, an offensive security specialist with nearly two decades of experience. He develops technologies and methodologies for anticipating threats, validating risks, and protecting business continuity.
Sources and case updates
Public information about the incident is preliminary and may change as the investigation progresses. Observations about Brazilian institutions in this article are analyses by the Vultus team.
