A Stolen Laptop, Six Billion Dollars, and the Myth of Decentralised Money

The simplest explanation is often the wrong one, and so is the most dramatic. When $6.36 billion vanishes from the world’s largest cryptocurrency exchange in roughly 20 minutes, the instinct is to picture a brilliant cryptographic break — a mathematical wall smashed by a superior mind. The evidence points somewhere far more ordinary, and far more troubling. The breach appears to have walked in through a door that every office on earth has: a single compromised laptop.

The Vault Whose Walls Were Paper

At 8:05pm UTC on 29 October, funds began leaving Binance wallets spread across ten blockchains. Most of the money was gone within about 20 minutes. Blockchain analytics firm Blockchain analytics firm TRM Labs counts $6.36 billion taken and calls it the largest crypto theft on record, attributing it to a North Korean-linked group called TraderTraitor: “We make this judgment with high confidence.” [1] Binance has not confirmed who did it For scale: this is roughly four times the $1.5 billion Bybit hack of February 2025, which the FBI tied to the same group. The US Treasury has previously said such stolen funds finance North Korea’s nuclear missile programme.

Binance’s early findings point to a hacked laptop belonging to a DevOps engineer — a staff member who runs internal systems. That laptop let the attacker reach an internal service and send unauthorised withdrawals. Binance said: “We have found no evidence of any wallet private key leak.” [1] The attackers appear to have reached the software that requests withdrawals, potentially instructing Binance’s own systems to approve the transfers. The investigation is continuing, and Binance said in a subsequent statement there may have been “additional points of breach.” [1].” Alan Woodward at the University of Surrey, UK, finds the mechanism hard to accept. [1] “It shouldn’t be possible for a single [developer] PC to be compromised and somehow for that to allow the entire exchange to be compromised,” he says. “I don’t understand how that can happen unless they’ve got the most ridiculous operational security.” Think of a bank vault with a beautiful steel door and a spare key under the mat. The mathematics held. The procedure did not.

When the Freeze Is the Only Brake

Here is the irony that runs through the whole affair. Cryptocurrency was founded on decentralisation — the idea that no single party controls the money moving through the network. In practice, the largest platforms are as concentrated as any bank. “Most crypto platforms are as centralised as any bank, with a small number of privileged individuals controlling billions,” says Clive Summerfield at FARx, a cybersecurity company. “The difference is that once crypto is transferred, it’s gone.” His image is exact: “You can build a vault with mathematical firewalls, but if the individual holding the keys can be duped, the vault is opened.” That centralisation cuts both ways. Because issuers can act, several firms and councils moved within hours — Tether, Circle, Ripple, World Liberty Financial and the Arbitrum Security Council froze about $2.7 billion, including more than $800 million frozen by Circle. A freeze stops money from moving; it does not return it. The attacker still held 18,270 units of Bitcoin and more than 420,000 units of Ethereum, about $2.4 billion that no issuer can freeze. Half the haul was stalled, half was simply gone. The very concentration that created the single point of failure is also the only brake that caught anything.

Woodward draws the contrast with conventional finance directly. “You would hope there’d be things like two-man rules or things that banks have for changing critical systems, but it doesn’t look like those were in place.” A two-person rule is the financial equivalent of a nuclear launch key — dull, bureaucratic, and the reason the worst case stays hypothetical. Its apparent absence here is the quiet centre of the story.

A Stolen Laptop, Six Billion Dollars, and the Myth of Decentralised Money (Image 1)

The pattern is not unique to crypto. Every industry that has consolidated operational control into a handful of privileged engineers — power grids, hospital networks, payment processors — carries the same shape of risk. The lesson is transferable precisely because it is unglamorous: the attack surface is rarely the crown jewel. It is the ordinary laptop that can reach it.

The Ledger That Remembers Everything

What makes this case unusual is that the crime scene is public. A blockchain is a ledger nobody can quietly edit, which means investigators can watch stolen coins move in real time — and so can the thieves’ adversaries. TRM Labs suggests preparations for the attack may have begun several days before the 20-minute drain. The same transparency that makes crypto attractive to its users makes it legible to forensic analysts, and the freeze operations depended on knowing exactly which addresses to mark.

The financial ripples spread beyond the exchange. Coinbase closed at $160.59, down 1.07%, then fell 4.82% to $152.85 after hours — though that drop combines the hack with a third-quarter earnings report released the same afternoon, so it does not measure the hack alone. Circle fell 5.65% after hours despite freezing over $800 million in stolen funds, and Robinhood dropped 4.59%, both dragged down by the breach. One company’s compliance success became the sector’s collective shiver.

Binance says its emergency fund, SAFU, plus company funds will cover all losses. The theft equals about 4% of the $144 billion it held before the hack, but withdrawals stay paused until a security scan ends. A reserve that can absorb a four-percent wound is a strong balance sheet and a weak alibi; the question customers will ask is not whether they are made whole, but why a single machine could reach the whole vault at all.

The open questions are practical ones. How many other exchanges run the same architecture and simply have not been tested? Which two-person controls exist on paper but not in practice? And if the attackers needed days of preparation to find one engineer’s laptop, what does that say about how much of the industry’s security rests on the habits of individual employees rather than on design? The mathematics of crypto remains sound. The human layer around it is still being audited, one stolen laptop at a time.

Sources

Newscientist — Quote source (original article)

A Stolen Laptop, Six Billion Dollars, and the Myth of Decentralised Money (Image 2)