Binance’s $6.3 billion hack exposes crypto’s biggest security weakness

The reported $6.3 billion Binance breach has put cryptocurrency security under renewed scrutiny, but the most significant concern may not be the amount stolen. Instead, the incident highlights how attackers can potentially bypass sophisticated blockchain defenses by exploiting something far more basic: trusted access to internal systems.

The cryptocurrency exchange initially said its investigation suggested a compromised DevOps engineer’s laptop may have allowed an attacker to access a service container and submit unauthorized withdrawals. In a later update, Binance said investigators had identified additional points of breach and were still establishing the full sequence. The company said it had found no evidence of leaked wallet private keys.

Blockchain intelligence firm TRM Labs estimates that approximately $6.36 billion was moved from Binance wallets on October 29 and attributes the attack with high confidence to North Korea-linked group TraderTraitor. TRM says the theft is the largest crypto hack on record, exceeding the approximately $1.5 billion Bybit breach in 2025. The attribution is the firm’s assessment; Binance says its investigation continues.

Binance sets aside funds to cover losses

In an October 30 update, Binance said it had set aside more than $6.34 billion in company funds and would absorb the financial impact, using its corporate treasury and Secure Asset Fund for Users. 

Of that amount, $5 billion is already held in the exact tokens affected by the incident. The exchange is sourcing the remaining approximately $1.34 billion through market purchases and over-the-counter transactions, aiming to reimburse customers in the same cryptocurrencies they lost. Binance said the process could take longer for less liquid tokens.

Binance also said it had frozen approximately $3 billion in affected assets on-chain with industry partners. Frozen assets are not necessarily recovered; the company says it is working with law enforcement, token issuers, and blockchain intelligence firms to trace and recover funds.

The exchange also said it would cover any confirmed shortfall using company resources and make user balances publicly verifiable through its Proof of Reserves system as the recovery progresses.

“We will weather this storm,” Binance said in a statement. 

Meanwhile, Binance founder CZ has challenged the focus on the dollar value of the reported theft, arguing that the focus should be on whether customers ultimately lose their money. In posts on X on Friday, CZ compared the Binance incident with the collapse of Mt. Gox, once the world’s largest Bitcoin exchange. According to his figures, the Binance incident involved approximately $6.36 billion in mixed cryptocurrency assets, including around 18,270 BTC and 420,000 ETH.

By comparison, Mt. Gox lost an estimated 650,000 to 850,000 BTC between 2011 and 2014. The holdings were worth approximately $450 million to $500 million at the time but would be worth more than $50 billion at today’s prices. CZ estimated that the losses represented between 5% and 7% of Bitcoin’s supply at the time.

He also distinguished between an exchange suffering a security breach and customers losing access to their funds, as happened with Mt. Gox and FTX.

In Binance’s case, CZ maintained that the exchange itself was the only victim and that users’ funds were protected. He said the company had reserved more than $6.34 billion to cover the losses.

Acknowledging the wider implications, he described the incident as “still a major disaster for the industry, Binance (and me).”

“It hurts, but we survive,” he wrote. “Most importantly, we protect our users.”

Experts point to an identity problem

While Binance focuses on recovering assets and CZ has emphasized the exchange’s ability to absorb the losses, cybersecurity experts say the reported attack exposes a deeper weakness in how crypto companies manage internal access.

Stefan Deiss, CEO of The Hashgraph Group, argues that the incident’s scale should not obscure the underlying security issue. He also warns that artificial intelligence is making it easier for attackers to identify weaknesses faster than organizations can address them.

“The sheer scale of this hack makes it look like a one-off, but it isn’t. AI is helping attackers find weaknesses faster than companies can fix them, and attacks like this are becoming more common, not less.

“However, this attack didn’t rely on anything state-of-the-art. The attackers compromised one engineer’s laptop and used his trusted access as their own. That is an identity problem: once a system believes you are someone it trusts, it lets you act.”

Javvad Malik, Lead CISO Advisor at KnowBe4, shares that assessment, arguing that the most damaging breaches often stem from privileged-access failures rather than sophisticated attacks on core technology.

“The Binance incident yet again shows the most catastrophic breaches rarely exploit exotic zero-days in core protocols, but instead hinge on privileged access failures. In plain terms, the breach reportedly began when attackers compromised an engineer’s laptop, which served as a stepping stone into internal infrastructure.”

Malik says companies need to separate everyday employee devices from critical financial systems, require independent approvals before large transfers, and introduce automatic spending limits to stop suspicious transactions before they cause significant damage.

Deiss also warns that the growing use of AI agents to approve payments, transfer funds, and manage business operations could introduce another layer of risk. If these systems are granted financial authority without adequate safeguards, attackers could potentially manipulate them through malicious instructions hidden in seemingly routine communications.

“Every agent needs a verified identity, a human accountable for it, firm spending limits, and an off switch,” he said.

The warning extends beyond cryptocurrency exchanges. As businesses increasingly delegate financial and operational decisions to automated systems, identity verification and control over privileged access will become central to protecting digital assets.

The Binance incident has also rattled wider markets. Bitcoin fell nearly 4% to around $77,594 on Friday morning, while shares of Circle Internet Group, Robinhood Markets and Strategy declined more than 6% in premarket trading. Strive and Bitmine also fell more than 4%.

With more than 300 million users and $34 trillion in reported trading volume during 2025, Binance’s response carries implications for the wider digital asset industry. Its ability to reimburse affected users addresses the immediate financial concern. Still, the breach raises a more fundamental question: if one device can compromise access to billions of dollars in digital assets, are crypto companies doing enough to secure the systems and identities behind their platforms?