Binance Hack Started With One Laptop: Lessons for Your Business

What's happened

On Thursday, Binance, the world's largest cryptocurrency exchange, was hit by what's being called the biggest crypto theft ever. Binance estimates the impact at around $6.3 billion. It has frozen roughly $3 billion of the affected assets, paused withdrawals while it rebuilds its withdrawal service, and says it will cover every customer loss.

The part that matters for every other business is how it started. In a statement on Friday, chief executive Richard Teng said the initial investigation suggests the incident may have started with a compromised engineer's laptop. Reports describe the device as belonging to a DevOps engineer, and some say it may have been a contractor rather than an employee. From that laptop, the attacker reached a service container (part of the system that processes transactions) and submitted withdrawals that looked legitimate.

Binance says it has found no evidence that wallet private keys were leaked, that the attack was more complex than one engineer's access, and that it has found further points of breach. Security firms tracking the stolen funds say North Korea's Lazarus Group is the most likely culprit. Nobody has explained yet how the laptop was compromised, and the investigation is ongoing.

Why one laptop is enough

You don't need to hold billions in crypto for this to apply to you. Most serious attacks don't break through the front door. They start on one device that already has access: a laptop that missed an update, someone working as a local admin, a contractor's own machine that nobody checked, or a login without multi-factor authentication.

Attackers like these are patient and well funded, and no single control would stop them on its own. But the same pattern shows up in attacks on businesses of every size, and the ordinary ones are far easier to stop.

This is what Cyber Essentials is for

Cyber Essentials is the UK government backed scheme that sets a secure baseline for every device that touches your business data. That includes laptops at home, phones, and the devices contractors and freelancers use for your work. Its five controls map neatly onto how a single laptop becomes a way in:

Secure configuration. No unnecessary software, no default passwords, and a PIN or password needed to unlock it.
Software updates. Supported operating systems and apps, with critical and high-risk fixes applied within 14 days.
User access control. Everyday work done without admin rights, admin accounts kept separate, and multi-factor authentication on cloud services.
Malware protection. Every device protected, not just the office ones.
Firewalls. Every device protected at the edge, wherever it's working from.

None of that is exotic. It's the baseline that means one person's laptop can't quietly become everyone's problem. And because it covers people working on their own devices, it forces the conversation many businesses never have: which outside devices can reach your systems, and are they up to the same standard?

What to do this week

List who has access. Staff, contractors, your IT provider, freelancers. Which devices do they use, and are you sure those devices are updated and protected?
Check your admin accounts. Who has admin access, and do they use it for everyday work? Our guide to checking who has admin access in Microsoft 365 takes about 15 minutes.
See where you stand. The free Cyber Essentials readiness check takes a few minutes and shows which of the five controls need work. If you'd like help getting certified, our Cyber Essentials packages have fixed prices.

If it happens to you

If a device in your business may have been compromised, disconnect it from the network but don't wipe it, and treat it as a cyber incident. The evidence on that laptop is how you find out what else the attacker reached.

$6.3 billion. One laptop. Your baseline matters.