Binance's $6.3 Billion Hack Raises Questions About Crypto Platform Security

Anchor Mohammed Jamjoom opened the program by describing the attack as being called the biggest cryptocurrency heist in history, adding that the shocks are still reverberating through the industry. The target was Binance, the world's largest crypto exchange, and attackers stole about $6.3 billion in client assets.

Analysts suspect hackers backed by the North Korean government carried out the theft, and many are asking how so much was stolen in less than half an hour. The program noted that this was not the first such heist, and that critics are calling for more regulation to restore investor trust. The anchor said the program would discuss whether cryptocurrency is still safe and whether such attacks can be prevented.

Reporter Imogen Kimber said the attack took about 20 minutes to steal more than $6 billion. Binance said the complex attack involved multiple security breaches and that the hackers used a self-destruct mechanism to make it harder to track them. Deposits and withdrawals are on hold while Binance rebuilds its system, and the company says it will put the rebuilt system through rigorous testing.

Binance told customers they would not lose their money. In a statement, the company said: "We're committed to covering all hack losses through our company funds. Your assets are safe." Binance also said it is carrying out a security review and working with blockchain tracers and global law enforcement to recover the funds.

US crypto analytics firm TRM said it is confident that North Korean state-sponsored hackers carried out the heist. The report noted that this would not be the first such case. The FBI says North Korea stole $1.5 billion from crypto exchange Bybit in 2025, and British blockchain analytics firm Elliptic says last year hackers linked to Pyongyang took $1.5 billion from a Dubai-based crypto exchange.

The report noted that North Korea is subject to extensive international sanctions and has limited access to the international banking system, which makes obtaining foreign currency difficult. TRM said $2.9 billion worth of cryptocurrency was stolen last year across almost 150 attacks, and the report said this leaves Binance's 300 million customers and users of other platforms asking how vulnerable their investments may be.

Jeff White, an investigative journalist and author of The Lazarus Heist, explained how the attack may have happened. Ordinary users typically buy cryptocurrency through a platform like Binance and store it in a digital wallet held within the exchange. White said that in this incident, an employee of Binance was tricked into having their work laptop compromised, and computer viruses were planted on it. He noted that the story is still evolving.

Binance said other intrusion methods were used alongside this one. The compromised employee was a software developer, which White said could give the hackers potentially deep-level access to Binance's internal systems. With that access and other options, the hackers were able to transfer out $6.3 billion in different types of cryptocurrencies. White said investigators are still gathering evidence on how the hack happened and how the employee was compromised, so the account is still emerging.

Lee Reiners, a lecturing fellow at Duke University and a former Federal Reserve Bank examiner, said he was not surprised. He said this is the biggest crypto theft in history and arguably the biggest theft of anything in history. In his view, the scale and the identity of the victim, which he described as the world's largest crypto exchange and presumably a well-resourced and sophisticated firm, are what make this case different from the usual weekly crypto hacks.

Reiners said the fact that such a firm was compromised indicates that all of crypto is vulnerable. He pointed to the 2014 hack of Mt. Gox, one of the first crypto exchanges, and to Bitfinex and Bybit as similar cases. He said crypto is attractive to attackers because of its nature as digital bearer instruments: once attackers have access to private keys, they can move crypto anywhere they want in relatively short order. He added that North Korea has very sophisticated laundering capabilities.

Anupam Chander, professor of law and technology at Georgetown University, said the attack definitely undermines trust in cryptocurrency platforms. He said Binance is one of the most trusted parties in the crypto sector and the largest of these platforms, and presumably has the most cybersecurity assets and sophistication. Compromising it would be a real blow to Binance's reputation and to the reputation of the whole industry.

Chander said that if a leading player can be compromised in this way, people will be afraid to put their money into crypto wallet systems, where they must trust a third party to hold their assets because that is easier. He noted that the alternative of holding the wallet yourself is itself dangerous, so there are dangers all around.

White said the case is part of a decade-long evolution in North Korea's activity, and that evidence is increasingly pointing to North Korea in this Binance hack. He said North Korea is accused of breaking into banks as far back as 2015-16, including the National Bank of Bangladesh, stealing millions of dollars to keep its coffers topped up. As cryptocurrencies became more widespread and the amount of money in crypto increased, he said hackers came to see the industry as the soft underbelly of the financial system.

White said there is a lot of money in crypto, protections are weaker than in traditional banking, and money can be moved out extremely quickly. Unlike pounds, dollars or yen that must move through the traditional banking system or be converted into notes or gold, crypto can be moved within minutes as a digital transaction, which he said makes laundering that money much easier.

Lee Reiners, who was asked to respond to White, explained that sending crypto means signing a transaction with a private key, which is an alphanumeric string of characters stored in digital wallets. He cited a saying in crypto, "not your keys, not your coins," meaning that once someone else has access to those private keys, they can move your crypto to any wallet they choose.

Reiners said crypto exchanges are honeypots. He said exchanges perform multiple functions that are normally separated and segregated in traditional financial markets: they act as the broker, the exchange and the custodian, holding customer assets.

Reiners said crypto platforms hold customer assets in hot wallets, which are accessible via the internet, and cold wallets. He said this structure does not exist in traditional securities markets, and that this is why Binance had to halt withdrawals. He asked what would happen if E*TRADE, Robinhood or Schwab in the United States were hacked; the New York Stock Exchange or Nasdaq would not shut down.

Reiners argued that because these platforms are vertically integrated, they are massively vulnerable to incidents like this. He said US regulators under the Trump administration have endorsed this business model, which he described as a cybersecurity vulnerability that is also rife with conflicts of interest, as seen when FTX imploded in the fall of 2022.

The anchor said cryptocurrency regulations vary around the world but that some controls exist. In the EU, service providers must be authorized and meet requirements to safeguard customers' digital assets, and some transfers must carry information identifying the sender and recipient. In the US, anti-money laundering rules apply to some crypto exchanges, which are required to identify customers and report suspicious transactions.

The program noted that in 2023 Binance agreed to pay $4.3 billion in penalties and assets for violating US anti-money laundering and sanctions laws.

Anupam Chander, the Georgetown professor, said he thinks regulation will come. He said some governments may look at this and say they are not comfortable with their citizens' assets being so vulnerable, particularly when financial organizations could put the whole citizenry at risk of massive theft. He noted that massive heists seem to be regular in this space, and that these systems can move massive amounts of money in 20 minutes, which he said poses an enormous risk to national economies.

Chander also said such channels allow bad actors to access huge amounts of capital, so it is not only North Korea doing this kind of hacking. He said that US prosecutors have long tracked the movement of such money, which he said is more traceable than paper money, and that it may be possible to reverse some transactions if the money has not yet been fully dispersed. He concluded that regulators and enforcers are likely to call for stronger regulation and better enforcement.

Lee Reiners said regulation is no panacea because regulated entities get hacked every single day, whether in finance or other sectors. He said that simply claiming a crypto exchange is regulated does not guarantee anything and can provide a false sense of assurance.

Reiners said the Trump administration and US financial regulators have essentially done the bidding of the crypto industry. He cited an effort over the summer to pass an industry-drafted, industry-friendly bill, which he said thankfully failed. He argued that the industry wants to say it is regulated so that people think it is trustworthy, without having to comply with meaningful regulations.

Reiners noted that the Bitcoin white paper was released 18 years ago, on Halloween, by Satoshi Nakamoto. He asked what benefits crypto has provided beyond a means to gamble, and said about $6 billion from the hack is being used to fund North Korea's illicit nuclear weapons and ballistic missile program, which he called a pretty dire cost.

He said aggressive regulation is warranted, but that regulation has to separate the crypto economy from the traditional financial system. He said that as dire as this is and as bad as FTX was, the silver lining was that FTX's collapse did not spill into the traditional financial system.

Reiners said there is no guarantee that Binance's reopening of withdrawals will go smoothly, so this could still be the very early stages of a broader crisis and contagion event. He said that over 18 years there is plenty of evidence that crypto does not belong anywhere close to the traditional financial system.

White said that when hacks happen, money has often appeared from the crypto industry to fill the hole left behind, as happened in the Bithumb hack, where Binance was among the companies that contributed. He said this can feed the idea that nobody really suffered, but cautioned that this is a big if, given that $6.3 billion is a very large amount. He noted that about $3 billion of the stolen money is believed to have been frozen, so Binance may be able to recover that part, but filling the other half remains uncertain.

Reiners said AI is definitely a factor. Although the details are still unknown, he said the speed at which attackers in the Binance case moved the funds suggests AI was probably used. He said cybersecurity professionals are already calling this episode Black October, linking it to a PHP vulnerability revealed a few weeks earlier that took a number of websites offline, including government websites.

He said AI is going to supercharge hacks, and crypto is not immune. He argued crypto may be a rife target because that is where the money is, so such incidents will likely become more frequent, though not necessarily at this scale.

Reiners said most experts predict a functional quantum computer by the end of this decade. Once that exists, he said, the cryptography that all of cryptocurrency rests on is vulnerable, adding that this is another challenge. He said he has never been one to predict the demise of crypto, but unless it gets its act together soon, the industry faces major challenges.

White said Reiners' point about quantum computing is well made and could become a very big problem. He said it will be interesting to see whether consumer adoption slows because of these attacks, noting that about one in 10 people in the UK own some kind of crypto asset.

Chander said the attack is another wake-up call, and that exchanges seem to receive one on an annual basis. He said that for a centralized player, cybersecurity is the critical issue because hackers are always trying to get in. He pointed to the structure of exchanges in which wallets are all stored in the same place, making it easy to move funds from one wallet to another using a compromised exchange.

He explained that once an attacker has inside access, they can access everything, move everything around and run off with the money. He said that if multi-billion-dollar runs or even hundred-million-dollar runs keep happening, people will eventually get fed up and regulators may conclude such services are unacceptable and shutter them. He added that governments must be careful not to harm the asset, since about one in 10 people in a country may hold it.

The program's guest, whose name is not identified in the transcript, said there are forces in and around the crypto industry who want better regulation, including better security regulation for these entities. However, there is a tension at the heart of the crypto community, because many people argue that crypto was meant to be new, radical and decentralized, and that regulating it like banks defeats that purpose.

The speaker said that this view holds that crypto should be open, free and democratic, and that policing it like a traditional bank is not right. The speaker noted that some people in the industry hold the attitude that the currency belongs to its users rather than to any authority, and that someone could write code that drives a coach and horses through regulation.