Binance theft exposes weak access controls, experts warn

Security specialists said the Binance theft exposed basic weaknesses in access controls rather than a failure in blockchain infrastructure. Their comments followed reports that about USD $6.3 billion was moved from the exchange across 10 blockchains.

Their criticism centred on the reported starting point of the attack, which several said appears to have been a compromised employee device or stolen credentials with privileged access.

The incident has drawn attention because of its scale, but experts said the mechanics resembled more familiar cyber intrusions inside corporate systems. They pointed to reports that no private keys were leaked and that the attacker may instead have abused Binance's own signing processes to approve transfers.

That distinction matters for banks, payments firms and fintech groups. The concern is not only whether an external actor can break encryption or penetrate wallets, but whether an attacker can gain access to an internal machine or account that a trusted system already recognises.

"What stands out to me is where the Binance hack appears to have started. Based on what Binance has shared so far, it involved a compromised laptop, not a suspicious customer or an unusual payment. Once the attacker gained that access, the transactions appeared valid to the systems processing them, and funds moved across multiple blockchains in minutes. That leaves very little time to intervene.

This also highlights why security governance, access controls, continuous monitoring and financial crime prevention cannot operate in isolation. Controls that only kick in once a transaction starts may already be too late. Teams need to identify compromised access early, whether that's a new device, an unusual login pattern or an employee account suddenly behaving differently, and connect those signals to what is happening with the funds. Just as importantly, there needs to be clear ownership and a coordinated response when those risks emerge," said Nauman Abuzar, VP, Risk & Compliance, SEON.

Abuzar's comments reflect a wider view in the cyber industry that fraud monitoring alone cannot stop attacks once an internal account has been hijacked. If a transaction appears authentic to the systems processing it, the window for intervention shrinks sharply.

Another concern is the level of authority attached to the compromised access. Security leaders said the breach suggests the attackers reached accounts or systems with unusually broad permissions.

"The compromised credentials in the Binance breach likely had elevated permissions, otherwise the hackers would not have been able to extract over $6 billion. Once attackers get inside an organization, the damage they can do depends on what they're able to access and what that access allows them to do.

"The flood of incidents in the past month should push every business leader to look closely at their access controls. Employees, service accounts and increasingly AI agents shouldn't have standing access to powerful permissions. Give them access when they need it and remove it when the job is done.

Always assume an attacker will find a way in, and plan to limit what they can do once there. That can make the difference between a contained incident and a crisis for the whole business," said Art Gilliland, CEO, Delinea.

Ordinary Foothold

That argument was echoed by other executives, who said the lesson from the Binance case lies less in the record amount stolen and more in how ordinary the initial compromise appears to have been.

"The record figure will get the headlines, but the ordinary foothold is the lesson. Binance says the attack may have started with a compromised engineer's laptop, used to reach a service that submits withdrawals. It has since found further points of breach. By its own account, no wallet keys were stolen. The estimated impact is around $6.3 billion, four times the previous record. About $3 billion was frozen within hours, with partners and law enforcement. That coordination is the part working well. Any company whose systems move money on instruction should know exactly which machines and accounts can trigger a transfer. Assume one of them will be compromised one day, and test whether the controls behind it hold. Record thefts start with ordinary footholds," said Samuel Hassine, CEO and Co-Founder, Filigran.

The comments underline a common message for financial institutions and digital asset platforms. Security teams need tighter visibility over which devices, identities and internal services can authorise transfers. They also need faster links between cyber monitoring, identity controls and transaction oversight. In the Binance case, specialists said the attacker appears to have relied on trusted access rather than broken cryptography.