The Binance Hack Took 20 Minutes. Who Was Watching?

It used to take years. Then days.

Mt. Gox lost its bitcoin over roughly three years. The thefts ran from 2011 into 2014 and nobody announced them until the exchange collapsed in February 2014, according to Nasdaq's ten-year retrospective (2024).

Ronin lost about $625 million on March 23, 2022. Sky Mavis found out on March 29, six days later, when a customer's withdrawal failed, as TechCrunch reported at the time (2022).

Bybit lost about $1.5 billion on February 21, 2025. The money left in one afternoon. Laundering the whole pile took the attackers ten days, per TRM Labs (2025).

Binance lost about $6.36 billion on October 29, 2026. Most of it moved in about 20 minutes, per TRM Labs (2026).

Years. Days. One afternoon. Twenty minutes. That is the trend line, and it is the only part of this story that applies to every business reading it.

The night of October 29

TRM Labs traced the whole night on the public blockchains (2026). Binance's own updates on X, October 29 and 30, as reported by The Next Web, fill in the rest.

The attacker started preparing at least 36 hours early. On October 28 a small wallet was funded through Tornado Cash, a service that hides where crypto comes from. On October 29 the attacker tested the attack code on two wallets, rehearsed the final version on a third, and four hours later installed it on a Binance hot wallet, the kind an exchange keeps online to pay out withdrawals.

At 20:05 UTC the money started moving. Five Binance wallets on the XRP Ledger emptied in four minutes. At 20:20 a Bitcoin hot wallet sent 18,270 BTC. On Ethereum, one transaction carried 50 pre-signed authorizations that handed the Binance wallet's behavior to a sweeper contract only the attacker could call. Three minutes and 24 seconds later, that wallet sent out 167,464 ETH and 63 other tokens in a single transaction. The sweeper stayed in place and kept emptying the wallet as new deposits arrived, six more times through the night.

Ten blockchains. One attacker. About half an hour for the bulk of it.

Binance's first update said a compromised DevOps engineer's laptop may have let the attacker into a service container that could submit withdrawals. By Friday it said the investigation had "uncovered additional points of breach," and co-CEO Richard Teng wrote that the attacker "did not simply use one engineer's permissions, and this was not a single 'one-click' action." Binance says it found no evidence of a private key leak, paused withdrawals, and will cover every loss from its reserve fund and company money (Binance on X, October 30, 2026).

Both TRM Labs and Chainalysis attribute the attack to TraderTraitor, the North Korean unit the FBI named for the Bybit theft. Binance has not named anyone. About $2.7 billion was frozen by stablecoin issuers within hours; the attacker still holds roughly $2.4 billion that no issuer can freeze (TRM Labs, 2026).

Was AI involved, and does it matter?

Nobody has published evidence that an AI model ran this attack, and I am not going to claim it. The chain shows something I find more useful to think about: automation that did not need a human in the loop once it started.

Fifty signatures prepared in advance so one would match whatever transaction count the wallet had reached. A rehearsal hours before. A sweeper that re-emptied the wallet six more times with nobody typing. The attacker also raced the defenders, selling about $325 million of freezable stablecoin for ETH at a discount of more than 10% in the first hours, because a 10% haircut beats a 100% freeze (TRM Labs, 2026).

That is an autonomous cyber attack in the plain sense of the word. Set it up, press go, let the code work. AI does not change that playbook. It changes who can afford to write it. The next crew does not need a nation's budget; they need a laptop and a weekend. The Next Web reported the same week that North Korea's hackers are already building their own AI tools (October 2026).

Why a 5- to 500-person business should care

You are not Binance. You do not hold six billion dollars in hot wallets. So why should a dental practice, a machine shop or a 40-person accounting firm care?

Because the entry point was ordinary. The first thing Binance named was one engineer's laptop. It became a six-billion-dollar event because of what that laptop could reach, and how fast the tooling moved once inside. Your version is a bookkeeper's laptop that can reach the payroll portal, or a front-desk mailbox that can reach the bank's email thread. Stolen credentials were the top way in across the breaches Verizon studied (Verizon 2025 DBIR), and ransomware showed up in 88% of SMB breaches in the same report.

The math is asymmetric. The attacker needs one win. You need to catch every attempt, and the window has shrunk from weeks to minutes. A Monday morning review of Friday's logs was a defense in 2014. In 2026 it is a post-mortem.

Asymmetric defense done right

If the attack runs on automation, the defense has to run on automation too, with a human where judgment is needed. The measure that matters is time to remediation: the clock from the first bad signal to the threat being contained. Three parts.

Detection in seconds. A developer's laptop that suddenly runs a tool it has never run, a login from a country your team is not in, a new rule quietly forwarding mail: the AI sees it the moment it happens, not at the next scheduled scan.

Containment in minutes for the clear cases. Malware on a laptop, a session token used from two continents at once: the agent isolates the machine or kills the session before anyone has read the alert.

A human on the high-risk call. Whether to lock the owner's own account at 2 a.m., whether a strange payment approval is fraud or a real vendor change: a security engineer makes that call and phones you. Machines handle the volume. People handle the judgment.

Compliance is not security. Binance publishes proof of reserves. The attacker had a rehearsal.

What AccuSights Protect would have seen and done

I will be straight about scope. Protect does not watch crypto hot wallets, and no small business product would have stopped a nation-state unit with a tested exploit of exchange signing infrastructure.

Protect, our managed SOC for small business, watches from day one your computers and your email, Microsoft 365 or Google Workspace. Sign-ins and cloud accounts get added during onboarding as your setup allows. That is where your version of this attack begins and where it is cheapest to stop.

So the laptop in this story is the part we are built for. The AI agent on that machine flags the new tooling and the odd outbound connection the minute they appear, and isolates the machine if the signal is clear. A security engineer in Chicago reviews it, decides what it is, and calls you. The AI SOC watches around the clock on every plan. The bad guys do not sleep. Neither does your SOC.

Time to remediation measured in minutes. That is the number to ask any provider for, and the number we are built around.

The ask

What are you waiting for? Get your own custom AI SOC watching your back 24/7/365. First 30 days free: $0 today, and cancel before day 30 to pay nothing.

Start Protect, 30 days free

Questions people ask

How long did the Binance hack take? About 20 minutes for most of the money. TRM Labs traced the first transfers to 20:05 UTC on October 29, 2026, and the big Ethereum sweep to 20:23 UTC. The preparation took longer: the attacker funded a wallet on October 28 and rehearsed the code on test wallets before installing it on a Binance hot wallet (TRM Labs, 2026).

Was AI used in the Binance hack? Nobody has shown that it was. What the evidence shows is automation: 50 signatures prepared in advance, a rehearsal the same day, and code that kept sweeping new deposits on its own for hours after the first theft (TRM Labs, 2026). Automation is the threat. AI makes that automation cheaper to build, which is why the defense has to be automated too.

Why does a crypto exchange hack matter to a 20-person business? Because the method scales down and the speed does not slow down. The entry point Binance named first was one engineer's laptop (Binance on X, October 30, 2026). Your version is a bookkeeper's laptop or the front-desk email. Once inside, the attacker's tooling moves money or data in minutes, and a Monday morning discovery is too late.

What is time to remediation and what should it be? Time to remediation is the clock from the first bad sign to the threat being contained. Binance's attacker moved most of the money in 20 minutes, and the first freeze landed 37 minutes after the main sweep (TRM Labs, 2026). For a small business the target is detection in seconds, clear threats contained in minutes, and an engineer on the phone for the calls that need judgment.

Twenty minutes was enough for them. Make sure it is enough for you too.