On 29 October 2026, the crypto exchange Binance was hit by what is reported to be the largest cryptocurrency theft ever, with about $6.3 billion taken. Binance has not yet published how the attack happened. Security researchers believe the attackers likely compromised the systems that sign and approve transactions.
Whatever the final cause turns out to be, the lesson applies to businesses of any size: attackers go after the accounts and systems with the most power.
What happened
According to blockchain analytics firm TRM Labs, funds left Binance wallets across several blockchains within a matter of hours. TRM attributes the attack to TraderTraitor, a hacking group with a link to North Korea, and says the attacker prepared in advanced and tested its tools before the main attack. Around $2.7 billion has reportedly been frozen so far.
You do not need to understand cryptocurrency to see the pattern. A single point of control, the one that approves the movement of money, was enough to cause a loss of historic size.
What is “powerful access”?
Every business has a few accounts and systems that can do far more damage than the rest. Typical examples are:
-
- IT administrator accounts that can change settings, add users and delete data
-
- The email accounts of the people who approve payments or change bank details
-
- Access to servers, a NAS and backups
-
- The cloud admin account for Microsoft 365, Google Workspace or similar services
If an attacker takes over one of these, they do not need to break into anything else.
Why attackers target it
Attackers look for the easiest path to the biggest result. A regular employee account gives them limited access. An admin account can let them read or copy files, switch off security tools, delete backups, create new accounts for later, or approve fraudulent payment.
These actions are also harder to notice, because they come from an account that is allowed to do them.
How to protect your most powerful access
A password alone can be guessed, stolen or reused from another breach. MFA adds a second proof, such as a code from an authenticator app or a security key. Start with admin, finance, and email accounts, and use an authenticator app or key instead of SMS codes where possible.
This is called least privilege. Staff should not use admin accounts for daily work, and access should match the role.
Payments, changes to bank details, and major system changes should be approved by a second person. It slows an attacker down and often stops a mistake.
Old accounts that nobody uses are easy to overlook, and easy to abuse.
Keep a short list of your admin accounts, who owns each one, and what it can reach. Review it every few months.
Logins at strange hours, new admin accounts and sudden permission changes are all warning signs. The sooner they are seen, the less damage is done.
Backups should have their own access, kept apart from your main admin accounts, so one stolen login cannot erase everything.
Technology and people both matter
Many attacks begin when someone is tricked into giving away a password through a phishing email or a fake login page. MFA helps a lot, but it works best together with employees who know how to spot the warning signs. Security Awareness Training turns your team into an early warning system, and tools such as endpoint detection and response (EDR) can help spot suspicious activity on devices if something slips through.
How ITM can help
ITM supports businesses in Vietnam with IT infrastructure assessments and ongoing IT support. Protecting your most powerful access starts with knowing where it is, and we can help at every step:
-
- IT infrastructure assessment: We review who has access to what across your systems, including admin accounts, shared accounts, old accounts that are still active and devices reachable from the internet. You get a clear picture of where your biggest risks are and what to fix first
- MFA and access setup: We help you turn on multi-factor authentication across your business systems and accounts and set up access rules so people only reach what their role needs, in every department.
- Cloud and network security: We review your cloud accounts (such as Microsoft 365 or Google Workspace) and your network settings, so remote access is limited to what is necessary.
- Backup and disaster recovery: We set up backups that are stored separately from your main systems and protected with their own access. We also test them, so you know your data can be restored if something goes wrong.
- Monitoring and endpoint protection: With endpoint detection and response (EDR) and system monitoring, unusual activity on your devices, such as strange logins or permission changes, can be spotted and handled early. ‘
- Security Awareness Training: We help your employees recognize phishing emails and fake login pages, which are among the most common ways passwords are stolen.
You do not have to do everything at once. Many businesses start with an assessment and fix the highest risks first.
Not sure who holds the keys in your business? Talk to our IT experts, and we will help you find out.
