Author
Marcus PetrovicDirector & Head of Client Strategy
If you run a business, or advise people who do, the Binance hack is worth understanding even if you have never bought a single bitcoin. On 29 October 2026, attackers took around US$6.3 billion in digital assets from Binance, the world's largest cryptocurrency exchange. Blockchain analysts at Elliptic described it as "almost certainly the single largest-known theft of any kind."
Most of the first wave of withdrawals was gone in about 20 minutes. Binance suspended customer withdrawals for close to two days, including for its Australian customers, while it worked out what had happened. Around US$3 billion of the stolen funds has been frozen, much of it by stablecoin issuers such as Tether and Circle, and Binance has said it "will fully cover the financial impact of the funds stolen in this incident" from its own reserves.
Binance can absorb a loss of that size, and it had the resources to get on top of the situation quickly. Most Australian businesses, if placed in a similar situation, couldn't absorb the cost and wouldn't have the resources on hand to respond quickly enough to limit the damage. That is why I think business owners and their advisers should pay attention, understand what happened and take steps to protect their own businesses.
Why should Australian business owners and advisers care about the Binance hack?
Crypto is no longer a niche interest in Australia. The latest Independent Reserve Cryptocurrency Index found that 33% of Australians have invested in or held crypto, the highest level the survey has recorded, and 41% believe crypto will be widely accepted by people and businesses. Investment is following. According to KPMG's Pulse of Fintech report, fintech investment in Australia reached US$456 million in the first half of 2026, up 78% on the previous six months, with digital asset and crypto businesses making up the majority of deals. New laws for digital asset platforms are due to commence in April 2027.
Businesses are part of this too. The ATO has specific guidance for businesses that accept crypto as payment, hold it as trading stock or keep it as an investment.
The bigger issue reaches well beyond crypto. Australians now pay for almost everything digitally. The Reserve Bank's 2025 Consumer Payments Survey found that cards made up around 73% of payments, cash around 15%, and that use of mobile wallets and PayID increased across every age group. For most businesses, nearly every dollar coming in and going out passes through online banking, payment platforms and accounting software.
The weak point at Binance was one staff member's laptop and the internal system that approves payments. Every business that moves money digitally has both.
How did the Binance hack happen?
The easiest way to understand it is to think about how a bank looks after its money.
A bank keeps most of its money in the vault. A smaller amount sits in the tellers' tills so customers can make withdrawals straight away. Crypto exchanges work the same way. Most funds are held offline in "cold storage" (the vault), and a smaller amount is kept in an internet-connected "hot wallet" (the till) so customer withdrawals can be processed instantly.
Binance's initial investigation suggests the attack may have started with a compromised laptop belonging to one of its engineers. From there the attackers reached the internal system that approves and sends withdrawals. They never stole the keys to the vault. Instead, they got Binance's own payments system to sign withdrawal instructions as if they were genuine, similar to a fraudster using a bank employee's computer to lodge transfers that the bank's system then approves.
Each instruction had to match a reference number that changes with every transaction. The attackers couldn't know in advance which number would be live, so they prepared 50 signed instructions with different numbers. Forty-nine failed and one worked, and that one let them empty one of Binance's busiest hot wallets. They also left a small balance behind so the wallet stayed open. When Binance's automated systems topped it up with new customer deposits, the attackers took that money too.
As Ari Redbord of blockchain intelligence firm TRM Labs told the ABC, "It's bank robbery, in this case, at the speed of the internet."
Who was behind the Binance hack?
On 31 October, the FBI publicly blamed North Korea, naming a state-sponsored group known as TraderTraitor. The same group has been linked to the US$1.5 billion Bybit hack in 2025. TRM Labs and Chainalysis have reached the same view, with TRM saying it makes the judgement "with high confidence." Binance itself has not named who was responsible, and the investigation is ongoing.
On 27 October, two days before the theft, Binance said it had blocked several North Korea-linked attacks over the previous week, with no systems compromised and no assets lost. Those attacks used a scam known as "Contagious Interview," where fake job interviews are used to trick people into running malicious software on their own computers. In Binance's words, "The attackers did not try brute force. They tried a job interview."
Binance has not said how the engineer's laptop was compromised, so we can't say whether the two are connected. What it does show is that even an organisation actively fighting off attacks can be breached through a single person's device.
What can business owners and advisers learn from the Binance hack?
Review how your business holds and uses crypto and digital finances
I should say up front that I'm no crypto expert. I am fascinated by the technology, though, which is why I sat down with Bisher Khudeira from Stormrake on the MG Academy Podcast to talk through how Australian businesses and advisers are using Bitcoin.
If your business holds or accepts crypto, the Binance hack is a good prompt to review the process around it. Where is it held, on an exchange or in a wallet the business controls? Who has access, and who can approve a transfer? Are transactions being recorded properly for tax and accounting purposes? Moneysmart notes that many crypto providers are not yet licensed, which means "you may not be protected if the platform fails or is hacked." Binance customers also found that money held on an exchange can be frozen at short notice, which is a cash flow risk in its own right.
The same questions apply to every other account your business uses. Who can log in to your online banking, payment platforms and accounting software? Who can change a supplier's bank details? Who approves a large payment? The attackers at Binance went after the system that approves payments, and in a smaller business that system is often one or two people and an email inbox.
Digital security is now a cash flow issue
The Australian Signals Directorate's latest Annual Cyber Threat Report puts the average self-reported cost of cybercrime at $56,600 for small businesses and $97,200 for medium businesses. That is before lost sales, time spent recovering and the damage to customer trust.
Breaches are happening to organisations of every size. On 21 October, PHP released emergency fixes for two critical flaws, nicknamed "PHP2Shell," affecting the software behind most business websites, and the Australian Cyber Security Centre issued a critical alert the same day. In September, the government confirmed that an OpenAI agent had gained unauthorised access to the Services Australia Medicare Statistics Reporting Service portal in June and reached non-public files. OpenAI said its models "took actions we did not intend."
If the world's largest crypto exchange, with all its resources, can be breached, everyday Australian businesses aren't exempt.
AI is raising the stakes
The PHP flaw had sat unnoticed in the code for more than a decade, and researchers using AI tools found it within weeks. The same tools are available to criminals. AI is becoming more capable at a remarkable pace, and it is making it faster and cheaper to find weaknesses in the software businesses rely on.
Business owners don't need to become technical experts. But keeping up to date with what AI can do, and how it is being used against businesses, is fast becoming a necessity for Australian business owners.
Are directors responsible for cyber risk?
In most cases, yes. Under section 180 of the Corporations Act 2001, directors must act with reasonable care and diligence, and that duty is increasingly treated as including active oversight of cyber risk. The Australian Institute of Company Directors (AICD) has noted that recent ASIC enforcement action means "directors must be able to demonstrate informed oversight of cyber risk."
The courts have backed this up. In February 2026, the Federal Court ordered FIIG Securities to pay a $2.5 million penalty over cyber security failures after a 2023 attack took around 385GB of data affecting roughly 18,000 clients. FIIG held a financial services licence, which carries its own obligations, but the message for every board is the same.
Our work at Mackay Goodwin is in insolvency, and having spoken with thousands of Australian business owners, I've seen how often an unexpected cost is the start of a cash flow problem. Binance had billions set aside to cover its customers' losses. For most businesses, a cyber incident comes straight out of working capital.
When that happens, I often see the same pattern. The director covers the gap by delaying BAS, PAYG or super payments, intending to catch up later. That can lead to a Director Penalty Notice and personal liability for those debts. If the company can no longer pay its debts as and when they fall due and keeps trading, the director may also be exposed to a claim for insolvent trading.
Record keeping matters here too. Companies must keep financial records that correctly explain their transactions, and crypto is no exception. If a company goes into liquidation without adequate records, the law can presume it was insolvent during that period, which can make an insolvent trading claim easier to bring against the director.
What should directors do next?
The checklists below come from Australian government guidance. Each item names its source so you can read the full guidance yourself.
If your business holds or accepts crypto
From Moneysmart (ASIC) and the ATO:
- Think about where it's stored. Moneysmart says a hardware wallet or "cold storage" held offline "may offer more protection." (Moneysmart)
- Know who holds the private keys. "If you lose your private key, you usually lose the crypto." (Moneysmart)
- Understand the platform risk. Many crypto providers are not licensed, and "you may not be protected if the platform fails or is hacked." (Moneysmart)
- Protect your log-ins. "An exchange or platform will never ask you to share your password." Don't click links in emails or texts claiming to be from your exchange, and use a private Wi-Fi network to access your account. (Moneysmart)
- Be careful what you sign. "If a signature request is not human readable … do not sign it." (Moneysmart)
- Keep complete records. Export your transaction history regularly and keep records for five years. If crypto is lost or stolen, a capital loss can only be claimed with evidence of ownership. (ATO)
For all your business's digital finances
From the Australian Cyber Security Centre, Scamwatch and cyber.gov.au:
- Turn on multi-factor authentication, starting with email and banking. (ACSC)
- Install updates as soon as they're released, and check automatic updates are on. (ACSC)
- Back up your data regularly, test the backups and keep a copy offline. (ACSC)
- Use passphrases or a password manager rather than reused passwords. (ACSC)
- Limit access so each person can only reach what their role requires, and review it often. (ACSC)
- Train staff to spot phishing emails, scams and suspicious payment requests. (ACSC)
- Verify any change to bank details by calling the supplier on a number you already have, not one from the email, and add an approval step for large transfers. (cyber.gov.au, Scamwatch)
- If money is lost, contact your bank immediately and report it to the Australian Cyber Security Centre. (cyber.gov.au)
From my side, I'd add two things. Make cyber risk a short standing item at board or management meetings, so oversight is regular and recorded. And check whether your business has cyber insurance, what it covers and what it requires of you.
Protecting your cash flow
A cyber incident is one of many unexpected costs that can put pressure on a business, and acting early gives you more options. Our articles on cyber security for small business, the PHP vulnerability and tax debt solutions for business owners are good places to start.
If your business is under financial pressure, or you're an accountant or adviser with a client in that position, get in touch with Mackay Goodwin for a confidential conversation about the options available.
This is general information only and does not constitute legal or financial advice. Every situation is different. For advice specific to your circumstances, please contact us directly.
References
- ABC News, FBI blames North Korea for Binance cryptocurrency exchange hack
- Euronews, How the Binance hack happened and who was behind it
- Chainalysis, Binance hack: tracing the $6.4 billion theft to North Korea
- TRM Labs, North Korea steals USD 6.36 billion from Binance
- Crypto Briefing, Binance blocks North Korea-linked cyberattacks
- Independent Reserve, Independent Reserve Cryptocurrency Index 2026
- Fintech News Australia, Australia's fintech investment surge
- Reserve Bank of Australia, Cash use in Australia: what the 2025 Consumer Payments Survey tells us
- ATO, Crypto assets used in business
- Moneysmart, Crypto assets
- Moneysmart, Crypto scams
- Australian Cyber Security Centre, Small business cyber security guide
- cyber.gov.au, Learn about account compromise
- Scamwatch, Hackers targeting businesses' emails in sophisticated scam
- Australian Signals Directorate, Annual Cyber Threat Report 2024-25 fact sheet for businesses
- ABC News, OpenAI hacked Medicare portal, Prime Minister says
- ASIC, FIIG Securities ordered to pay $2.5 million over cyber security failures
- AICD, How Australian directors can manage evolving cybersecurity compliance obligations
Get in touch
Speak to one of our experts now for a free consultation. Enter your details below or call 02 8001 6520.