Binance Case: The Biggest Crypto Heist Ever Was Five Months in the Making

On 29 October 2026, attackers drained $6.34bn from Binance's hot wallets, in what the BBC reports is believed to be the largest hack in history. The FBI attributed it to TraderTraitor, the North Korean group also known as Lazarus, which took $1.5bn from Bybit in 2025. North Korea denies the accusation.

The headline number is about crypto. The story underneath is about identity. According to the update Binance published on 3 November, as reported by the Guardian, the operation did not start in October. It started in June, with one engineer, one piece of malware, and a map of who held the keys.

Five months later, the attacker triggered the final script from one engineer's computer, using another engineer's credentials. Every step in between was, at some level, an identity signal.

Five months, four moves

The attack ran from June to 29 October 2026, roughly 130 days from first foothold to final strike.

Binance says $2.85bn of the $6.34bn has been frozen or intercepted, and that it will cover all customer losses.

Endpoint got them in. Credentials got them out.

The Binance heist was a combination of two attack surfaces: the endpoint and the identity. Malware on two laptops gave the attacker a foothold. Stolen credentials and privileged access turned that foothold into $6.34bn.

That split matters, because no single tool owns the whole chain. Stopping a malicious download on a developer's laptop is the job of EDR and security awareness. Social engineering through a fake recruiter is hard to block with any technology at all. An identity platform would not have stopped the first click, and claiming otherwise would be dishonest.

But the endpoint is where the attack began, not where it ended. Between June and October, the attacker had to discover privileged identities, compromise them, move across them, and finally use them. That middle stretch is identity territory, and it is the part most security stacks watch least.

Where following the identity could have helped

We don't know how Binance's wallet infrastructure is connected to its identity providers, and we won't pretend to. What we can do is look at the publicly reported chain and ask where continuous identity tracking changes the odds. Not prevention: earlier visibility, and a shorter path from signal to response.

1. The credential that showed up on the wrong machine. On 29 October, the first engineer's credentials were used from the second developer's computer. To most tools, a valid login is a valid login. To a platform that follows each identity as one continuous story, an identity suddenly operating from a device it has never used, next to critical systems, is a meaningful deviation. In Thor, that signal doesn't fire alone. It is correlated with everything else that identity and its team have done.

2. The signals that would have aged out. The first compromise happened in June. The final strike came roughly 130 days later. A platform that keeps 90 days of detectable history would have lost June's signals before October arrived. Thor correlates across the full activity history, so an analyst investigating the October activity can pull in what happened to the same identities months earlier, and see one attack instead of unrelated events.

3. The AI tool nobody was scoring. The attacker used an internal AI tool to take control of two developers' systems. That raises a simple question: was that tool inventoried as an identity, with its permissions known and its risk scored? 8Layers treats AI agents, service accounts, API keys and OAuth tokens as first-class identities, with the same depth as human accounts. Unusual activity from an AI tool against privileged users' systems is exactly the behaviour that should be visible.

4. The team the attackers mapped first. In June, the attacker learned who held access to the wallet infrastructure. Defenders should know that map better than the attacker does. Posture management in Octagon shows each privileged identity's blast radius, so the identities that would cause the most damage get the most scrutiny.

One alert, not four. None of these signals is conclusive on its own. Thor builds signals over time and only fires when a real kill chain emerges. The analyst gets one alert per attack, with the timeline, the related identities and the causality graph already reconstructed, and can block, kill sessions, revoke tokens or scramble credentials from the same screen. In a case like this one, the gap between 20 and 29 October was nine days. Nine days is a lot of time for a SOC that is looking at the right story.

What CISOs and SOC teams should take from it

The target was not crypto. The target was engineers with privileged access, and every bank, retailer and critical service has them.

• Know your privileged identities better than the attacker does. Map who can reach your most critical systems, human and non-human, and what each identity could break.
• Treat AI tools as identities. If an internal AI tool can act on systems, it needs an owner, scoped permissions and continuous monitoring.
• Watch credentials in context, not in isolation. A valid login from the wrong device is not a valid login.
• Check your detection window. If your stack forgets after 90 days, a five-month operation is invisible by design.
• Keep the layers working together. EDR protects the endpoint; identity security follows what happens after. Neither replaces the other.

The grand finale is the last chapter, not the first

By the time $6.34bn left Binance's wallets, the attack had been running for five months. The final script took minutes. The story that led to it took a summer and an autumn.

That is the case for following every identity, human or not, as one continuous story with no time limit. 8Layers unifies posture, detection and compliance on a single identity data layer, so a finding from June can still be context in October, and an analyst sees the whole chapter, not just the ending.

See how Thor reconstructs an identity attack from first signal to final move. Book a demo.