Binance Has the ISO Certificate. North Korea Has the Money.

On October 29, 2026, $6.36 billion disappears from Binance, the world’s largest crypto exchange. Most of it in 31 minutes. The perpetrators have a name and a case number, and their method has been in an FBI advisory since April 2022. Binance is ISO 27001 certified and supervised in several countries. This text is about what a certificate proves. And about what a warning is worth when it is read but not acted on.

Author

Daniel Thomas Heessel, CISO of the Year 2026, ISO 27001 Lead Auditor

Audience

CISOs, management, financial and crypto companies, SOC

Classification

TLP:CLEAR, sharing permitted

As of

November 1, 2026, version 1.0

Sources

TRM Labs, Elliptic, Bitquery, BitOK, Binance, CNBC, FBI, CISA, US Treasury, Mandiant, GitHub, Palo Alto Networks Unit 42, Wiz, xorl

The actual attack on Binance begins one day before the theft of $6.36 billion. On October 28, the adversary sets up a wallet and, via a service that conceals where money comes from, sends it about one ether, a little over $2,000. On October 29, the adversary tests the attack code against third-party wallets. Four hours after the last test, the code sits on a Binance hot wallet, a wallet that is constantly online because the exchange uses it to process customer withdrawals.

At 8:05 p.m. UTC, 9:05 p.m. in Frankfurt, the outflow begins, first on the XRP Ledger. All further times are UTC. Within 20 minutes, Solana, Optimism, Bitcoin and Tron follow, then Ethereum, where most of the money sits. There, the adversary had obtained 50 signatures from the Binance wallet in advance. One of them is enough to bring the wallet under the adversary’s control. Three minutes later it is empty: 167,464 ether and 1.6 billion Tether in a single transaction. Until midnight, the adversary comes back six times and sweeps whatever customers have deposited in the meantime. Ten blockchains, one adversary, half an hour for what matters.

The adversary is slowed down not by Binance but by the companies that issue stablecoins such as Tether and USD Coin. They can freeze their tokens at the push of a button. At 9:01 p.m., Tether freezes $971 million, 37 minutes after the big outflow, and Circle freezes $823 million three minutes later. The adversary sees the freezes coming and sells whatever can still be sold, at a discount of more than ten percent. Binance halts withdrawals at around 10:33 p.m. and reports first findings at 2:25 a.m.

By morning, $6.36 billion is gone. $2.7 billion of it sits frozen at the adversary’s addresses, and $2.4 billion in ether and bitcoin is out of reach. One question remains: how does someone get Binance wallets on ten blockchains to sign their transactions?

Binance answers the next day, cautiously. The incident may have started with the laptop of a DevOps engineer, meaning a technician who runs the exchange’s systems. Through this laptop, the adversary is said to have reached an internal system and triggered withdrawals from there. It was not a one-click attack, there were further entry points, and private keys had not been leaked. TRM Labs goes a step further: the adversary had probably taken control of the system Binance uses to sign its withdrawals.

A laptop. Anyone who has understood that sentence knows the rest of the story. This attack path had been in an FBI advisory for four and a half years.

Binance was founded in 2017 and has been the world’s largest crypto exchange ever since. In early 2026, the exchange held reserves of around $155 billion and turned over $2.1 trillion in one month, 2.6 times as much as the next competitor. Depending on how it is counted, between a quarter and almost 40 percent of global spot trading runs through Binance. That is where the price of bitcoin is set. When Binance wobbles, the market wobbles: after the attack, bitcoin lost five percent within hours, and shares in Coinbase and Robinhood fell. Binance is to crypto what a systemically important bank is to the money market, only without deposit insurance, without published financial statements and, for a long time, without a headquarters.

The doubts are almost as old as the exchange. In 2019, Binance lost 7,074 bitcoin from a hot wallet because adversaries had collected user credentials through phishing; the alarms went off when the money was already gone. In 2022, an adversary stole around $570 million from the blockchain that Binance itself operates. The exchange then simply halted the entire network, which should not even be possible on a supposedly decentralized blockchain. On top of that came the corporate structure: dozens of companies, no audited financial statements. A proof of reserves from the auditor Mazars at the end of 2022 lasted only days, then Mazars withdrew from the crypto business. In 2023, the US Securities and Exchange Commission accused Binance of commingling customer funds worth billions. In November 2023, Binance and founder Changpeng Zhao pleaded guilty to failing to maintain an effective anti-money laundering program: a $4.3 billion penalty, a compliance monitor in-house, four months in prison for Zhao. President Trump pardoned Zhao in 2025, and Zhao remained the largest shareholder. Since then, Richard Teng, a former financial regulator, and co-founder Yi He have run the business.

In Europe, the MiCA regulation with its licensing requirement has applied since the end of 2024. Binance did not get a license, withdrew its application and largely discontinued its offering for EU customers in July 2026. Teng then criticized Brussels: 70 percent of the affected users had moved their money into self-custody wallets, where the risk was higher. That sentence is worth remembering.

Yet on paper, Binance is a model student. The exchange has been ISO 27001 certified since 2019, one of the first crypto platforms to be so. In 2023, certificates for France, the Emirates, Bahrain and Turkey followed, along with a SOC 2 report for the global platform. The then head of security spoke of proven effective controls. Binance has not published whether the certificates are still valid in 2026 and cover the wallet systems. For this text, that does not matter. The question is not whether a certificate was missing but what a certificate proves. The supervisory rules surrounding Binance deal with money laundering, client assets and transparency. None of them asks how to protect a technician’s laptop against a North Korean adversary posing as a recruiter.

Who did it is considered settled. TRM Labs attributes the attack with high confidence to the North Korean group TraderTraitor, and the FBI confirms North Korean perpetrators. To understand this group, you have to go back to the beginning: to a paper from Washington.

On April 18, 2022, the FBI, the cybersecurity agency CISA and the US Treasury publish a joint paper, 14 pages, readable by anyone. It describes a North Korean campaign against crypto companies and gives it the name TraderTraitor. The entry point, according to the paper: employees of crypto companies, often system administrators and DevOps technicians, are offered highly paid jobs via job portals and messengers and are asked to install software for them that takes over the computer. The paper lists the names of the programs, the checksums of the files and the addresses of the servers. It can still be downloaded today.

The group has since acquired many names: UNC4899 at Google and Mandiant, Jade Sleet at Microsoft, Slow Pisces at Palo Alto Networks. Mandiant assigns it to the Reconnaissance General Bureau, North Korea’s foreign intelligence service. Its goal is not espionage but foreign currency.

Where it sits in the state apparatus can be reconstructed from public sources. Since 2021, the security researcher xorl has maintained a map of North Korea’s cyber units, built on Mandiant’s analyses, US indictments and defector reports. According to it, the chain of command runs from Kim Jong Un through the General Staff to the intelligence service, there to the 3rd Bureau and on to Lab 110, the core of what the world calls “Lazarus.” TraderTraitor is the line in this network that specializes in crypto assets. The US Treasury placed Lazarus exactly there in 2019: in the 110th Research Center of the 3rd Bureau.

This organization is no phantom. It has bureau numbers, front companies in China, employees indicted by name and a mission. In 2024, the UN Panel of Experts estimated that North Korea had stolen more than three billion dollars in crypto assets since 2017; a successor body puts the share of cyber loot in the country’s foreign currency earnings for 2024 at around one third. According to the UN and the US government, the money flows into the missile and nuclear program. Whoever empties Binance finances warheads.

The 2022 paper describes the first act. The group has performed the other six in plain sight since then. Each one is documented and carries numbers from MITRE ATT&CK, the technique catalog that is the industry’s common language.

Four things make this play so successful, and none of them is a software vulnerability: a person with privileged access; multi-factor authentication that does not detect stolen sessions; service providers as the entry point; patience that ends in a single strike.

None of this was secret. The chain of warnings begins in April 2022 and becomes more precise every year.

In March 2024, a supposed recruiter contacted an employee of the Japanese wallet company Ginco and sent a hiring test on GitHub. Two months later, the adversaries used the employee’s session data to manipulate a transaction of the customer DMM Bitcoin: $308 million. In February 2025, a developer at the wallet company Safe launched a Docker project that posed as a stock simulator. Twelve days later, Bybit was $1.5 billion poorer. In April 2026, Drift and KelpDAO followed, and in September, Bitget. And in October, Binance, four and a half years after the FBI had named DevOps technicians at crypto companies as a preferred target. In April 2025, Unit 42 had noted that the group’s approach had remained the same for months. Why change anything? It worked.

Since April 2022, every victim was preceded by a report describing the entry point it would be hit with shortly afterwards. This is not a story about vulnerabilities. It is a story about what comes after reading.

For years, I have audited information security management systems as a lead auditor, and I have built four myself. An ISO 27001 certificate proves that an organization operates such a system: that it assesses risks, implements controls and audits itself internally. The auditor sees this in samples, a few days a year. The standard even explicitly requires threat intelligence, that is, the analysis of information about adversaries. The auditor checks whether this process exists. Whether a technician’s laptop withstands a fake recruiter is not something the auditor checks. That does not fit into any audit program.

Binance had threat intelligence. For years, the exchange has tracked down North Korean loot, and it employs one of the largest security teams in the industry. The knowledge was there. It was not translated into architecture and detection. That is the difference between threat intelligence and Threat-Informed Defense, and this night proves it.

The architecture: whoever gets the signing system for wallets on ten blockchains to sign within half an hour hits no limit. Nothing stopped a wallet that paid out more in three minutes than it normally does in weeks. $6.36 billion in one night is not just a detection problem. It is an architecture decision.

Detection: this attack announced itself. A freshly funded wallet, test runs on the day of the attack, then 15 minutes between the first outflow and the access to Ethereum, then 37 minutes until the first major freeze by Tether. Whoever hunts for the adversary’s behavior has hours of lead time that evening. Whoever only works through the control catalog sees nothing until the outflow. The attack was discovered not by Binance’s own detection but from the outside. The pattern is familiar from Germany: in the Berlin state network, a data exfiltration went unnoticed for five days, and there, too, it was discovered from the outside.

The human factor: the laptop of a technician with access to withdrawal systems is not an office computer. It deserves as much protection as a company’s central directory service. No code from a recruiter’s repository is run on such a device. That rule is not in any certificate. It is in the reports on DMM Bitcoin and Bybit.

And the certificate itself: it is not worthless. It proves that Binance operates a management system. It proves nothing about the question that decided this evening: whether an organization knows its adversary and has built and tested its defense against the adversary’s techniques. Certificates measure whether processes exist. Adversaries measure whether they work. Binance went through both measurements. It passed the first in 2019. The second took 31 minutes.

Binance bears the loss, not its customers. The day after, Richard Teng said the company had set aside $6.34 billion in corporate funds. On October 31, the exchange reported that 90 percent of the stolen holdings had been replaced, from three pots: the emergency fund SAFU, an insurance fund for derivatives trading and the group’s treasury. Withdrawals are resuming in stages, and a new proof of reserves has been announced.

Nobody outside can verify this; Binance does not publish financial statements. Teng says the group holds its profits in crypto assets and can absorb the loss. With two trillion dollars in monthly trading volume, that is plausible, and so the question of whether the biggest bankruptcy in crypto history is looming comes too early. FTX did not collapse in 2022 because of a hack but because customer funds were gambled away. Binance insists that its customer funds sit untouched in cold wallets that are not connected to the internet. The test comes when all withdrawals are open again.

Frozen is not recovered. The $2.7 billion that Tether, Circle, Ripple and others have frozen is stuck at the adversary’s addresses; getting it back takes courts and time. What stands out is who acted: no regulator, not the exchange, but private companies that can freeze their tokens at the push of a button. The crypto world, which cultivates freedom from censorship as its founding myth, was saved from the worst by exactly the kind of central intervention it rejects.

The $2.4 billion out of reach is more than any single earlier crypto heist. It is moving via bridges, exchange services and traders toward Pyongyang, like the loot from Bybit, Drift, KelpDAO and Bitget. With $6.36 billion, a state under comprehensive sanctions captured more in one night than the UN panel attributed to it for six years in total. Without exploiting a single vulnerability in any software.

And regulation? Binance left Europe in July, so EU customers were hardly affected. Teng’s sentence from July sounds different now: this time, the higher risk was not in customers’ wallets but in a hot wallet of the exchange. Experts told CNBC that US regulators would not have prevented this incident either, because it started with a laptop. Rules on money laundering, client assets and transparency produce audit reports. They do not produce resilience.

Every major incident is followed by calls for more rules, more certificates, more evidence. The Binance case refutes this reflex. Binance was certified, audited and supervised. The perpetrator was known by name, its techniques cataloged. None of that mattered in the 31 minutes when it counted. Compliance alone does not stop adversaries.

The mistake lies in the order. Whoever starts with the control catalog defends against the standard. Whoever starts with the adversary defends against the adversary.

Threat-Informed Defense answers three questions: Who is attacking us? How do we detect them? What do we do to make them fail? Binance could answer the first. It failed at the other two, like Bybit, DMM, Drift, KelpDAO and Bitget before it. What this requires is laid out in this case; the eight actions that follow from it are at the start of this advisory, each assigned to one act of the attack chain.

The lesson reaches beyond crypto. The same technicians, signing systems and cloud sessions exist in every bank and every insurer. The difference lies not in the number of rules but in what they test: existence or effectiveness. European financial supervisors have understood this: DORA requires large financial entities to run tests that replicate the techniques of real adversaries against their own organization. That is Threat-Informed Defense with the force of law.

Binance knew who was coming. It knew how. It was certified. And in one night it lost $6.36 billion to an adversary the FBI had warned about four and a half years earlier. Binance still has the certificate. North Korea has the money.

Caveats on the facts (as of November 1, 2026). The entry via the DevOps laptop has so far come from Binance alone; a technical post-incident report has been announced. The assessment of the signing infrastructure is an evaluation by TRM Labs. TRM makes the attribution to TraderTraitor with high confidence, and the FBI confirms North Korean actors. The link to Bitget drawn by BitOK is an analytical attribution, not a proven identity. Drift and SEAL 911 attribute Drift to the cluster UNC4736, not TraderTraitor; the North Korea attribution of Bitget is unconfirmed. The certification information is based on Binance press releases from 2019 and 2023; whether the certificates are valid in 2026 and cover the wallet infrastructure has not been published. All loss amounts are valuations at the time of the outflow. The times of the night come from TRM Labs, Elliptic, Bitquery, BitOK and Binance’s statements, the time of the withdrawal pause from press reports. Technique IDs per MITRE ATT&CK Enterprise.

ATT&CK

MITRE knowledge base of adversary tactics and techniques; T numbers denote techniques

Attribution

Assigning an attack to an actor, with a statement of confidence

Cold wallet

Wallet with no connection to the internet, used to hold large balances

DevOps

Teams that develop software and run the systems it runs on; they often have far-reaching privileges

Issuer

Company that issues a stablecoin and can freeze its tokens

Hot wallet

Wallet that is permanently online so the exchange can process withdrawals from it

MFA

Multi-factor authentication

RGB

Reconnaissance General Bureau, North Korea’s foreign intelligence service

Session cookie

Session data after a successful login; whoever steals it needs neither password nor second factor

Stablecoin

Token with a fixed value, usually pegged to the US dollar, such as Tether (USDT) or USD Coin (USDC)

Threat-Informed Defense

Defense that starts from the known behavior of real adversaries rather than from the control catalog

TLP

Traffic Light Protocol: marking that indicates how widely information may be shared

TTP

Tactics, Techniques, Procedures: how adversaries operate