Certified Isn't Finished: What the Binance Incident Teaches Every Security Team

On 29 October, Binance suffered one of the costliest security incidents in the history of the tech industry. The headline figure is about USD 6.34bn impacted. Just two days later Binance published a generously transparent report of their initial findings, benefiting every security team in Web3 and any other tech organisation.

I have worked with 1inch¹ as interim Head of DevOps, interim Head of IT, and technology advisor across most functions and teams, and together we read the report the way most security teams will have read it. We weren't asking "How could this happen to Binance?" – a client and trusted partner. We were asking "where could this happen to us?" and humbly challenging our own setup. 1inch¹ is SOC 2 Type 2 and ISO 27001 certified, but so is Binance. Achieving a standard to pass these certifications is demanding, but it only gets you started; the hard work carries on every day after the audit.

What happened to Binance

The full detail is in Binance's initial report – it is worth a full read. In short, attackers linked to the DPRK gained access to Binance hot wallets largely through social engineering, and stole USD 6.34bn worth of funds. It was a sophisticated and highly targeted attack planned and executed for months, with multiple vectors. What is fascinating is how small and seemingly unremarkable the human errors were that helped attackers succeed:

1. One engineer installed a tampered tool on their device; they found it through a search engine.
2. Another engineer took a lucrative fake job interview from their work computer and downloaded an "assignment", which was actually zero-day malware that got attackers in.

Certified isn't finished

Binance and 1inch are both SOC 2 Type 2 and ISO 27001 certified. Both standards are very demanding; each needs months of preparation before an independent auditor comes in to scrutinise the evidence of controls working in practice, not only on paper. One could ask how a company that takes security this seriously could fall victim to such an attack. But a certificate describes a system at a point in time, not every possible scenario. Unfortunately, attackers don't go after the system as audited; they go after the system as lived in, on a Tuesday afternoon, by a tired engineer with a deadline and a recruiter in their inbox.

So we think about security for 1inch as two pillars that hold each other up:

1. Discipline. Proven practice, done the same way every time, which the standards make you not only write down but also demonstrate consistently.
2. Culture. People who understand why the practice exists, ask questions, and speak up when something feels off.

1inch fights for both. Discipline without culture turns into box-ticking and paper-pushing, which people quietly work around. Culture without discipline is good intentions with nothing to hold them.

Discipline

The most useful thing SOC 2 and ISO 27001 do is take security out of the realm of opinion and force proven best practices. A business can't just say it's careful – "Trust me, I'm an engineer!" It has to show evidence of doing the boring but necessary things consistently and on schedule. That includes:

• Least privilege. People and services get the access their job needs and nothing more. A deployment token that can reach a signing service is a privilege question before it's a malware question.
• Just-in-time (JIT) access. Sensitive access is requested, approved, time-boxed and logged, not held permanently. Standing access is what an attacker hopes to find when they land on a laptop. Access that expired an hour ago is worth nothing to them.
• Access reviews. Someone regularly checks who can reach what, and removes what's no longer needed. Access builds up over time unless someone prunes it on purpose.
• Device management. Company machines are enrolled, encrypted, patched and monitored. What gets installed on them, and from where, is a policy, not a personal choice.
• Change management. Changes to production go through review and leave a trail. "I just deployed a quick container" is the kind of sentence a change process exists to catch.
• Supplier and software supply chain controls. Tools come from verified sources, with checksums and pinned versions. A package manager is software too, and a search engine result is not a trusted source.
• Incident response in practice. A plan that has never been run is a document, not a capability. Drills show where the runbook says "revoke the key" and reality says "which key, and who can?"

None of these practices are new or exceptional, and the growing use of AI has only amplified their impact. Security is proven practices done consistently, and industry standards simply force that consistency into the open, making it visible to auditors, clients and the team itself.

Culture

Effective security requires that every control and best practice is in fact practised by everyone. Each and every person in the organisation must do the right thing even when their manager, the auditor, or the Security Officer is not watching. That's where culture comes in, and 1inch consistently increases the effort and time spent on it.

Education that never stops. Regular baseline training, which is the bare minimum certifications require, is just that – a baseline. Attack techniques and the tech landscape change monthly if not weekly, and training has to keep up. We share and discuss real cases as they happen, Binance's report included, and walk through what it means for 1inch together.

Knowledge sharing over silos. Team members consistently report phishing, reach out to IT and Security to verify the legitimacy of communications, and an engineer who spots a strange recruiter message or a typo-squatted software package tells everyone instead of silently deleting it. That way one person's near miss becomes a free lesson for the rest.

Attack victims come forward early and without fear. We want people to report a suspicious link they nearly clicked or clicked, the laptop they left unlocked, the file they downloaded and now regret. Blameless post-incident reviews and making reporting and getting support easy help 1inch discover, prevent and mitigate attacks quickly. A fearless report that arrives in minutes is the one that saves businesses. If speaking up gets people shamed and/or blamed, they simply stop speaking up, and the first you hear of a problem is from the attacker or the news. Senior engineers raising their hand to say: "I think I've been phished, help" without concern for their ego is a testament to a strong security culture.

Explaining the "why" behind seemingly boring controls. Mandatory training, drills, least privilege, JIT access and the access request that takes ten minutes are all friction and annoy passionate innovators who want to move fast. Friction without a reason feels like bureaucracy, and clever people will find a creative way to route around it. Friction with a clear and well-understood reason will feel like a fair price to pay for protection. When someone asks why they can't keep production access "just in case", the answer is a story like Binance's. Standing access is what an attacker hopes to find. When someone asks why we run another incident drill, the answer is that on the night the business is attacked – a question of when, not if – defence and mitigation boil down to doing what has already been practised, not learning new skills from scratch.

People tend to follow rules they understand and find sensible, and most of the security work that matters is continuously educating the team and fostering understanding.

Systems get smarter so people become the main target

Technical defences improve, and, thanks to everyone using the same AI tools, the arms race between attackers and defenders is very tight. Attackers move to where resistance is lowest – increasingly, humans.

Again, none of this is new. Kevin Mitnick's Ghost in the Wires (with William L. Simon, 2011) is a memoir of breaking into some of the best-defended companies of the 1980s and ’90s, mostly with a telephone and a confident voice. Social engineering in tech has been alive and well for decades and con artists have existed for millennia. What's changed is the scale and sophistication that AI has brought to it.

The research is consistent:

• The human element is in most breaches. Verizon's 2026 Data Breach Investigations Report finds a human element in 62% of breaches, rising to 65% in financial services.
• AI-written phishing works as well as the experts. In a study by researchers from Harvard Kennedy School and others, fully AI-automated spear-phishing emails got a 54% click-through rate, against 12% for the control group. That's on par with phishing written by human experts, at a fraction of the cost.
• Voice and video can no longer be trusted by default. In early 2024, engineering firm Arup lost USD 25.6m after an employee joined a video call with what appeared to be the CFO and several colleagues. All of them were deepfakes. CrowdStrike's 2025 Global Threat Report saw voice phishing (vishing) rise 442% between the first and second halves of 2024.
• Fake job interviews are a known DPRK playbook. Palo Alto Networks' Unit 42 has tracked "Contagious Interview", a long-running campaign in which fake recruiters ask developers to run "assignment" code that installs malware.
• Tricking humans works at scale. Chainalysis estimates DPRK-linked groups stole USD 2.02bn in crypto in 2025, up 51% on the year before and about 60% of all crypto stolen. The biggest single theft, Bybit's roughly USD 1.5bn in February 2025, started on one developer's Mac after they ran a Docker project disguised as a stock-trading simulator. MFA didn't help as stolen session tokens got around it.

Put Bybit next to Binance and the pattern is hard to miss. In both cases the infrastructure was serious and well defended, and the first step was a staff member's laptop and a believable story.

The lesson isn't that people are the problem but that they are now the main target, and need the same investment we give our firewalls. That means training that keeps up with the threats, and systems designed so that one compromised laptop can't reach everything.

Small errors that undo everything

Some of the most instructive security failures I've seen in my career weren't sophisticated at all; they exploited tiny vulnerabilities in otherwise iron-clad systems. A few of my favourite classics no one wants to talk about:

• The unlocked laptop. Someone with production access steps away to make a coffee and leaves their screen unlocked. "Surely a senior person wouldn't do it!" – but they do, a lot. Where environments were informal enough to permit it, I would use their unlocked laptop to type something like: "I love having tea and biscuits with tiny mice on a Thursday afternoon" in a public Slack channel. A somewhat cruel but harmless joke that would make them a laptop-locking expert for life.
• The company laptop or phone used as a personal one. Personal browsing, side projects, games for the kids, and, as in Binance's case, a job interview's take-home task. A work device may only ever hold and be used for work. Anything else belongs on a separate machine together with mistakes made on it when not thinking about work.
• The mantrap with the open windows. I have seen a company install a mantrap at the office entrance: two doors, each requiring a badge to open; only one door can open at a time, and only one person can go through at a time. Very impressive and very high friction when you go to lunch as a group of 5 and spend 10 minutes getting back in. It was a hot summer, so the ground-floor windows along the side of the building were wide open and staff were smart enough to figure out a faster way to get in and out of the office. The best door in the world doesn't help when the wall next to it has a hole (or a wide-open window).
• The hardware key on the desk. A physical security key or a cold wallet is only as safe as where it lives – ideally in a safe or on the person who owns it. Left on a desk, it's an invitation to anyone walking past: the cleaner, the visitor, the "contractor" nobody quite remembers letting in because they tailgated.
• Tailgating. Letting someone with their hands full, a friendly smile, and a warm "could you hold the door?" through without asking for their badge isn't good manners; it's voluntarily letting a stranger past access control in the building. It's not only normal but required to ask them to badge in themselves; you can help them hold whatever they're carrying instead.
• Saying too much in an interview. Interviews invite candidates to show what they know and have experience in; often they show more than they should. In one DevOps interview, a candidate demonstrating their setup used a port forward that opened up their own traffic to us, and on a work laptop too. Interviewers have the same risk – under pressure to impress they sometimes share screens, configs and stories they shouldn't instead of a polite "I'm sorry, I am unable to disclose this".
• The screen everyone can see. I once stood next to a commuter on a packed train into London who was reading classified UK government material on their device. I hadn't gone looking for it; it was simply there at eye level, for anyone standing in the aisle. A privacy screen filter costs a few pounds, and choosing not to open certain documents or terminals in public costs nothing, and both are highly effective at preventing data leaks. Remote work and travel turn every café, airport and train into an open-plan office with strangers, and staff must be trained to act responsibly.

Each of these scenarios comes down to humans doing normal human things – being busy, kind, proud of their work or simply hot and late from lunch. Written rules and technical controls alone don't fix the problem, especially not in a fast-moving industry. People need to understand why being vigilant and proactively following the rules matters, and to feel comfortable saying "sorry, would you mind badging in?"

What we're doing with 1inch and what your own team should do

Binance's report has gone into our own review cycle at 1inch, as a real-world drill rather than a news story. Without going into internal detail, here's where we're looking:

• Re-checking the path from a laptop to anything that signs or deploys. If one device were compromised tonight, what could it reach, and for how long?
• Moving more standing access to just-in-time access, and shortening how long the access that remains lasts.
• Tightening where tools come from: package managers, AI coding tools, browser extensions. Official sources, verified installs, nothing from a search result.
• Running the recruiter-scam scenario in training, using this case and Bybit's, so the first time someone sees a "take-home assignment" attack isn't in their own inbox.
• Rehearsing the response, including the awkward parts. Who can pause what, and what can't be undone by pausing it, such as on-chain authorisations.
• Making it easier to come forward. Short blameless reporting for anything that feels off, followed up quickly and visibly, so people see that speaking up gets results.

Unlike a certification or attestation round, security work is never finished. The honest answer to "Are we secure yet?" is yes, for now, because of what we keep doing continuously, not something we did once. Certification shows the world you've built solid foundations; what actually keeps you safe is the daily practices preventing one unlocked screen, one held door and one suspicious interview at a time.

---

¹ 1inch is the brand and product name. The company behind it is Degensoft Ltd, which holds the SOC 2 and ISO 27001 certifications referred to in this post.