The breach.
The Binance breach of 29 October is still under investigation, but the intelligence picture is already clear enough to act on. TRM puts the loss at $6.36 billion, which it calls the largest hack in history.
Binance’s preliminary findings identify a potentially compromised DevOps engineer’s laptop as a likely entry point into an internal service capable of submitting withdrawals. It has since disclosed additional breach points.
Binance says it has found no evidence of private key leakage; that’s the detail that matters.
TRM’s analysis identified valid signatures across multiple blockchains and assessed that the attacker gained the ability to make Binance’s hot-wallet infrastructure sign transactions of its choosing.
The attacker didn’t defeat the cryptography. The attacker compromised the people and processes authorized to use the keys.
This has happened before.
In the DMM/Ginco case, the FBI described fake LinkedIn recruiter outreach, a malicious Python coding test hosted on GitHub and session-cookie abuse, leading to manipulation of a legitimate transaction request.
Bybit’s February 2025 breach followed a different initial path, a compromised developer environment at Safe, its third-party wallet provider, but reached the same destination: the systems and workflows that authorize transactions, according to Sygnia’s investigation.
Twenty months after Bybit, a similar playbook appears to have succeeded again. So why do red team exercises still rarely model it?
Because most scenarios assume an attacker must extract a key.
Don’t test it. Prove it.
The demonstrated threat is an attacker who causes legitimate infrastructure to sign malicious instructions. Stealing a key and controlling the signer are distinct attack objectives. If your red team only chases the first, you’ve never faced the second.
For organizations outside crypto, the same attack could target a production deployment pipeline, a software-signing operation or a privileged service action.
The question is the same: what can compromised engineering access influence, beyond the credentials it can expose? If you can’t answer that, you haven’t been attacked the way Binance was.
Knowing an attacker can’t steal your key doesn’t tell you whether they can make your systems use it.
Those are different problems. Attack both.
CovertSwarm helps crypto and digital asset companies outpace threats by attacking them the way groups like TraderTraitor do, then proving what that attacker could reach.
Note: Based on public reporting available on 30 October 2026. Binance’s technical post-mortem remains pending and its full internal attack path has not been publicly established.