What is known, and what is not yet known
What is known, according to CNBC: the incident impacted about US$6.3 billion in client assets, making it the largest crypto theft on record; for comparison, the 2025 Bybit hack cost roughly US$1.5 billion. About US$3 billion was frozen on-chain in the following hours, because stablecoin issuers have that power: Circle froze more than 800 million in USD Coin and Tether more than 1.5 billion of its stablecoin. The FBI determined that North Korea was responsible.
What is not known: how the attacker actually got in. CNBC's 31 October report notes that it still is not clear how the attack was carried out. That sentence deserves respect. In the first days of any incident, the public version is the best hypothesis of the moment, and it changes. Everything that follows in this article starts from the initial hypothesis released by Binance itself, with that explicit caveat.
The vector, with the necessary caveats
Binance initially said the hack may have involved a compromised DevOps engineer's laptop, which allowed an attacker to gain access to a service container, then used to submit unauthorised withdrawals. Days later, according to the same CNBC report, co-CEO Richard Teng said the attack involved a more complex process rather than the misuse of a single engineer's permissions. The two statements do not contradict each other: the second says the laptop was the beginning, not the whole story.
For readers outside crypto, a translation: a DevOps engineer is the person with access to the servers, the keys and the deployment tools. In an ordinary company, that is the ERP administrator, the person responsible for the file server, or the accountant who holds the bank password. The attack did not need to break Binance. It needed one machine, and from it a path to the container that had permission to move money.
One workstation, one container, everything
The chain the initial hypothesis describes has three links, and each one is a question for your company. First link: the workstation of a professional with privileged access was compromised. How many machines in your company, if compromised, would give access to the main system? Second link: from that machine it was possible to reach a production environment. Does access to production require something beyond the machine itself, such as a hardware key or a second person's approval, or is being logged in enough? Third link: the environment reached had permission to execute the most sensitive operation in the business. Is the system user that generates the payment file the same one with permission to approve it?
The pattern is not new and not exclusive to crypto: compromised workstation, reused credential, lateral path to whatever is worth money. What Binance makes visible is the scale of what happens when the third link has no brake. In a small company, the third link is the batch Pix transfer, the payroll, the export of the customer database, or access to the cloud console where every server lives.
What would have held: five controls that fit a small company
First, least privilege: every person and every system with access only to what it needs, and access to production through a controlled entry point with short-lived credentials, instead of permanent keys stored on laptops. Second, multi-factor authentication on everything that matters, and for administrators and finance, hardware keys: CISA states that the only widely available phishing-resistant authentication is FIDO/WebAuthn. A code by SMS is better than nothing, but it is exactly what today's attacks bypass.
Third, dual approval for operations that move money or data in bulk: batch payments, production deployments, database exports. Whoever prepares is not whoever approves. Fourth, threshold alerts: a transfer above a given amount, a withdrawal outside business hours, an export larger than usual, a new administrative login. An alert that reaches a partner's phone within two minutes changes the outcome of an incident. Fifth, hygiene on the workstations of anyone with privileged access: updated system, encrypted disk, no local administrator rights for day-to-day work, and separation between the work machine and the machine where any attachment gets opened.
Who absorbs the loss
Binance announced it would absorb the financial impact of the stolen funds, not its users, and on 31 October reported that 90% of the stolen assets had already been replenished, with a proof of reserves showing all major assets fully backed. Withdrawals were resumed in phases, starting with the Bitcoin network. A company with a multi-billion reserve fund and insurers survives a day like 29 October.
A 30-person company has no reserve fund. It has the LGPD, whose article 48 requires the controller to notify the National Data Protection Authority and the data subject of a security incident that may cause relevant risk or harm, and it has the three-working-day deadline from the ANPD regulation to do so. It also has the month's cash flow, the customers who will ask questions, and its local reputation. The article on backups, ransomware and the real cost of an incident breaks that bill down component by component. The point here is a single one: the cost of an access control is predictable; the cost of an incident is not.
How JBKR applies this to the systems it supports
JBKR's security and privacy page describes the practice, and it is exactly the list above applied to ourselves and to clients: named, auditable access, never shared credentials; mandatory MFA on cloud accounts, repositories and admin consoles; secrets out of laptops and in credential vaults; production environments reached through controlled paths; and a record of what was done, by whom and when. When we take over a system built by another team, the first week of the assessment is largely about discovering who has access to what and closing what should not be open.
In cloud projects, the access design comes before the server design: separate accounts per environment, roles with minimum permissions, two-person approval for production changes, and cost and access alerts from day one. None of this requires a global exchange's budget. At JBKR the initial 30-minute assessment is free, and the first security question is always the same: if the laptop of the person who administers your system were compromised today, what would the attacker reach?
