How attackers walked out of Binance with 7,000 bitcoin

In May 2019, attackers withdrew 7,000 bitcoin — about $40 million at the time — from Binance, then one of the world's largest crypto exchanges. They did it in one transaction.

What actually happened

Binance said the attackers used phishing, viruses and other methods to collect a large number of user login details, two-factor codes and API keys. They waited patiently, then moved everything at once.

The human lesson

• Two-factor codes stop nothing if a person types them into a fake page.
• Attackers collect quietly for weeks before they strike.
• One reused password can unlock far more than one account.

The technology was not the weak point. The moment of trust was: a click, a code, a familiar-looking screen.

What to do this week

• Switch high-value accounts to passkeys or security keys.
• Train people to never type a code they didn't request.
• Run a realistic phishing test before an attacker does.