Topic starter
06/11/2026 6:38 pm
TL;DR: A compromised employee computer helped attackers reach transfer approvals and move about $6.3 billion from Binance, according to Tonic, showing how shared credentials and delegated authority can turn a routine endpoint compromise into a financial-loss event. Pausing a service does not necessarily cancel the permissions it already granted.
Editorial analysis by NHI Mgmt Group, based on content published by Tonic: “The Binance hack: an executive view”.
Key questions
Q: What should teams do first when a compromised employee account can reach critical systems?
A: First, disable the account or its active sessions, then revoke privileged entitlements and reset any shared secrets tied to it.
Q: Why can pausing a service fail to stop an attack already in motion?
A: Pausing a service may stop the user interface, but an attacker already inside can keep using active sessions, API tokens, service accounts, or cached credentials.
Q: How do shared credentials increase the blast radius of an endpoint compromise?
A: Shared credentials let one compromised endpoint expose every system that trusts the same secret, because there is no per-device identity to contain the breach.
Practitioner guidance
- Define separate approval paths for asset movement Require an explicit second control for any action that can move money, change wallets or trigger production effects, even when the request comes from a trusted internal account.
- Break the link between developer access and release authority Review which engineering identities can reach signing, deployment and transfer functions, then remove overlaps that let one compromised workstation influence multiple trust domains.
- Test revocation beyond account disablement Run exercises where disabling the originating account still leaves a scheduled job, delegated permission or token active, then verify that responders can cancel the remaining authority.
Bottom line: A single compromised workstation can become a route to payments or production if delegated authority and shared credentials are too broad.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/11/2026 6:41 pm
The real control failure is the gap between account compromise and permission revocation. This incident is not only about a stolen workstation, but about authority that continued to exist after the first access path was interrupted. That is a governance problem for IAM, NHI and workflow owners alike: a valid session or approval chain can keep working even when the originating account is no longer trusted. The practitioner lesson is to govern the permission itself, not just the login that created it.
A question worth separating out:
Q: What is the difference between authentication and authorization in IAM?
A: Authentication proves an identity is who or what it claims to be. Authorization determines what that identity can do after it is accepted. In production environments, authorization is usually the harder and more important control because it governs scope, duration, and blast radius.
👉 Read our full editorial: Binance theft shows how one compromised computer can reach payments