Binance hack warns firms on compromised work laptops

Andrew Willdig, Chief Executive Officer of iStorage, has warned businesses to treat staff laptops as a likely point of compromise after the record Binance crypto theft. His comments followed Binance's claim that the attack may have started with a single compromised work laptop.

Binance said about USD $6.3 billion was taken in the incident, which would make it the largest crypto theft on record. The exchange said its initial investigation suggested the attacker made unauthorised transactions after gaining access through an engineer's laptop.

Blockchain analysts at TRM Labs reported that most of the funds left Binance wallets in about 20 minutes. Binance also said roughly USD $3 billion of the stolen funds has been frozen, while the BBC reported that Tether and Circle froze some assets linked to the incident.

Willdig said the attack showed why companies should assume a staff device will eventually be breached and design systems to limit what can be reached from that machine.

He pointed to wider exposure across the UK economy. The government's Cyber Security Breaches Survey 2025/2026 found that 43% of UK businesses, or about 612,000 firms, reported a cyber security breach or attack in the previous 12 months.

"What stands out is not the size of the number, it is where it reportedly started. Not a vault, not a server room, but an everyday work laptop. Too many organisations still treat the laptop as the safe place to keep their most sensitive files and credentials. The reality is that it is the device most exposed to phishing and malicious downloads, so it is exactly where attackers look first," said Andrew Willdig, chief executive officer of iStorage.

The incident has drawn attention for the speed of the theft and the suggestion that an ordinary endpoint device may have provided the opening. That scenario has become central to security planning as companies rely on laptops to access payment systems, internal tools and customer records.

Willdig said many businesses would not have the recovery options available in parts of the crypto sector, where issuers and exchanges can sometimes freeze digital assets after a breach.

"Recovering funds after something like this is the exception. For a typical UK business, once financial data have been copied off a compromised machine, there is no button to press to get them back. Protection has to be in place before the attacker arrives, not organised afterwards," he said.

Access controls

He argued that the main failure in cases like this is often not only the initial compromise, but also the level of access available once a machine is infected. If a single laptop can reach systems that move funds or hold sensitive records, he said, the exposure is already built into the organisation's design.

"Attackers rarely need to break encryption. They wait for someone to unlock the door for them, whether that is a password typed on an infected laptop or a file left decrypted on a machine that is already compromised. If one compromised laptop can reach the systems that move money or hold customer data, that is a design problem, not just a people problem," Willdig said.

He said firms should separate systems used for payments and sensitive data from devices used for email and web browsing, and keep sensitive material encrypted when not in use. He also argued against allowing a single person or device to approve high-value transactions alone.

"Keep the systems that move money or hold sensitive data separate from everyday email and browsing and keep sensitive data encrypted when it is not in use. That is the thinking behind hardware encryption. If the PIN is entered on the device itself rather than typed on the laptop, an infected machine has nothing to capture. No single laptop or person should be able to approve a high-value action alone. And be careful where your security hardware comes from. Always purchase from trusted resellers, because a device that has been tampered with before it reaches you undoes everything else," Willdig said.

That warning on procurement follows confirmation from hardware wallet maker Ledger that devices sold through a reseller in Malaysia had been fitted with a hardware implant. The point underlines a broader cybersecurity concern that hardware itself can become part of the attack path before it reaches the end user.

Speed of attack

For Willdig, the pace of the Binance theft is one of the most significant details. TRM Labs said most of the stolen funds left Binance wallets in roughly 20 minutes, a timeframe that, he said, leaves little room for organisations that rely on detecting intrusions after they begin.

"Twenty minutes is less time than most organisations take to notice something is wrong, let alone respond. A plan that relies on spotting an attack and reacting to it will always be a step behind. The question for every board is: if one of your laptops was compromised this morning, what data could be accessed by lunchtime? If the honest answer is 'too much', that is where to start," Willdig said.

Blockchain analysts have linked the attack to North Korea's TraderTraitor group. Willdig said smaller organisations should not conclude from that attribution that they are unlikely to face similar methods.

"The techniques used against the biggest firms filter down quickly. Tricking an employee, taking over their device and using their access is not reserved for billion-dollar targets. It is how many everyday breaches start," he said.