Binance Hack 2026: What Happened and How to Stay Protected

On 29 October 2026, the world woke up to the largest cryptocurrency theft ever recorded. According to Binance and blockchain analytics firm TRM Labs, roughly 6.3 billion US dollars left Binance wallets across ten blockchains, most of it in about 20 minutes. The Binance hack is around four times bigger than the Bybit hack of February 2025, which held the record until this week.

The most important detail is not the amount. It is how it started: a single compromised employee laptop. That makes the Binance hack a lesson for every business, not just for crypto exchanges. And it did not happen in isolation. In the same fortnight, attackers began exploiting a critical PHP vulnerability known as PHP2Shell, and several companies disclosed data breaches affecting millions of people.

In this article we explain what happened in the Binance hack, what the PHP vulnerability means for any business with a website, and the practical cybersecurity best practices that protect you from the same kind of attack. Information is current as of 30 October 2026; the investigation is still developing.

Binance hack: the key facts at a glance

• What: around 6.3 billion dollars in crypto stolen from Binance wallets, the largest crypto hack in history.
• When: 29 October 2026, with most funds moved in about 20 minutes.
• How: a compromised employee laptop gave the attacker access to an internal service that could submit withdrawals.
• Who: analysts at TRM Labs attribute it to TraderTraitor, a North Korean state-linked group. No official attribution yet.
• Customers: Binance paused deposits and withdrawals and says it will cover all losses. Tether and Circle froze part of the stolen funds.

What happened in the Binance hack?

Binance says the breach started on one employee's laptop. From that device, the attacker reached an internal service container and was able to submit unauthorised withdrawal transactions. In other words, nobody "broke the blockchain". The attacker simply got inside through a trusted device and used the company's own systems to move money.

Binance suspended deposits and withdrawals while it investigated and has stated it will cover customer losses. Stablecoin issuers Tether and Circle froze funds linked to the attack. The reported frozen amounts vary between outlets, from roughly 2.5 to more than 4 billion dollars, and will likely change as recovery continues. Bitcoin fell about 5 percent in the hours after the news broke.

Who is behind the Binance hack?

TRM Labs attributes the Binance hack to TraderTraitor, a North Korean hacking group linked to the wider Lazarus Group activity, and Chainalysis reportedly reached a similar assessment. No government has confirmed this officially yet, so treat it as a strong analyst assessment rather than a proven fact.

The method fits a well-known pattern. These groups rarely attack technology head-on. They go after people: fake job offers sent to developers, booby-trapped files, and work devices that can be compromised quietly. The human and the endpoint fail first.

The real lesson: one laptop was the front door

The single biggest cybersecurity lesson from the Binance hack is simple. One unprotected or compromised laptop can open the door to an entire organisation. That is true for a global exchange and it is just as true for a 20-person company in the Algarve.

Every laptop, desktop and phone that can reach company data needs modern endpoint protection with detection and response, not just a basic antivirus. It has to be centrally managed, patched automatically and isolated within minutes when something looks wrong. That is exactly what we deploy and manage for our clients with ESET PROTECT.

PHP2Shell: the PHP vulnerability every website owner must patch

While the headlines focused on the Binance hack, a second story was affecting far more businesses. On 21 October 2026, the PHP project released emergency patches for two critical remote code execution flaws now known as PHP2Shell. Details had leaked two days early, forcing a rushed release.

What are CVE-2026-109618 and CVE-2026-109619?

They are two vulnerabilities in PHP itself, each rated 9.2 out of 10 in severity by the PHP project. Both can allow an attacker to run their own code on a server without logging in. On 26 October, the US Cybersecurity and Infrastructure Security Agency (CISA) added both to its Known Exploited Vulnerabilities catalogue, which means attackers are actively using them. Researchers at watchTowr and Cloudflare have also reported exploitation attempts in the wild.

Why the PHP vulnerability matters for your business

PHP powers a huge share of the web: WordPress, WooCommerce, many online shops and countless custom business applications. If your website runs on an unpatched PHP version, an attacker could steal customer data, deface your site, serve malware to your visitors or use your server as a stepping stone into the rest of your network.

How to fix PHP2Shell

• Update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or later). Updating is the only complete fix.
• Ask your hosting provider or web agency which PHP version your site runs, today.
• Keep watching the official PHP advisories: a related flaw, CVE-2026-115560, was published on 23 October and is not fixed by those updates.
• Check server logs for suspicious activity since mid-October, when the first signs of exploitation appeared.

Other cyber attacks and data breaches in October 2026

The Binance hack and PHP2Shell are the headlines, but October 2026 has been one of the busiest months for cyber attacks this year:

• Sony So-net (Japan): a data breach affecting around 2.5 million ISP customer records.
• Railway: the cloud platform warned that customers' API keys and secrets stored in environment variables were compromised, and urged everyone to revoke them.
• ConnectWise: a breach reportedly exposed credentials used to connect to organisations that back up their Microsoft 365 data.
• PingCAP: the database company said an extortion group had access to its systems for a month.

The common thread is not exotic technology. It is stolen credentials, unpatched software, exposed secrets and attackers who stay inside networks for weeks before anyone notices.

8 cybersecurity best practices after the Binance hack

You do not need to be a crypto exchange to be a target. Most attacks are opportunistic: automated scans looking for an unpatched PHP server, a reused password or a laptop without protection. These are the cybersecurity best practices we recommend every business applies now.

1. Patch fast, starting with internet-facing systems

Update PHP, WordPress, plugins, firewalls and VPNs as soon as critical patches are released. Vulnerabilities like PHP2Shell are exploited within days of disclosure, not months.

2. Protect every endpoint

Use a business-grade, centrally managed endpoint protection platform with detection and response on every device that touches company data. The Binance hack started on a single laptop. ESET PROTECT is the platform we use with our clients.

3. Turn on multi-factor authentication everywhere

Email, Microsoft 365, banking, hosting panels, remote access and admin areas. Prefer authenticator apps or hardware keys over SMS codes. Our business e-mail security solutions include multi-factor authentication and protection against phishing.

4. Apply least privilege and four-eyes approval

Employees should only have access to what their role needs, and nobody should be able to move money, export data or change production systems alone. An IT audit quickly shows who has access to what.

5. Store secrets properly and rotate them

API keys, passwords and tokens never belong in shared documents or plain files. After any breach notice from a supplier, as with Railway, rotate credentials immediately.

6. Train your people

Phishing emails, fake job offers and malicious attachments remain the number one entry point. Short, regular security awareness training is one of the cheapest and most effective controls you can buy.

7. Keep tested, offline backups

Keep at least one copy offline or immutable, and actually test restoring it. Backups are your last line of defence against ransomware. Ask us about backup when planning your cloud solutions.

8. Have an incident response plan

Even a one-page plan helps: who decides, who contacts customers and authorities, and which partner investigates. Our IT consulting team can help you write and test it.

How to stay updated on new hacks and vulnerabilities

Staying informed is part of staying protected. Follow official sources, not social media rumours:

• The CISA Known Exploited Vulnerabilities catalogue, the best list of flaws attackers are actually using.
• Your national cybersecurity centre: in Portugal, the Centro Nacional de Cibersegurança (CNCS).
• The security advisories of the software you use, such as PHP, WordPress and Microsoft.
• Your suppliers' security notifications, so you hear about breaches like Railway or ConnectWise directly.

If you hold cryptocurrency, follow your exchange's official status page and announcements only. In the days after a major hack like the Binance hack, scammers send fake "refund" and "account verification" emails to exploit the confusion. Never enter your credentials through a link received by email or message.

Binance hack: frequently asked questions

How much was stolen in the Binance hack?

Binance estimates about 6.3 billion US dollars and TRM Labs about 6.36 billion, making it the largest crypto hack in history. A significant part has since been frozen by stablecoin issuers, and the figures may still change.

Is my money safe on Binance?

Binance has stated it will cover all customer losses, and early analyst commentary suggests the breach does not create meaningful solvency risk. Use Binance's official channels only and ignore unsolicited messages offering refunds or recovery.

What is PHP2Shell?

PHP2Shell is the name given to two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that allow remote code execution and are actively exploited. The fix is updating PHP to 8.5.12, 8.4.27, 8.3.36, 8.2.35 or later.

Could a hack like this happen to a small business?

Yes. The Binance hack started with one compromised laptop, and PHP2Shell affects ordinary business websites. Small and medium businesses are frequent targets precisely because they often lack endpoint protection, patching routines and security training.

How Strong Answer protects your business

The Binance hack proves that even organisations with enormous security budgets can be breached through one weak point. The good news: most attacks against small and medium businesses are stopped by getting the fundamentals right. That is what our cybersecurity team does for companies across Portugal and the Algarve:

• Security assessment: we find your weak points before attackers do.
• External penetration testing of your websites and internet-facing systems.
• Security awareness training so your team recognises phishing and social engineering.
• Managed endpoint protection with ESET PROTECT on every device.
• Website maintenance and PHP updates by our web team.
• Ongoing IT support from our technical support team when something looks wrong.