The US$6.3 billion Binance hack is the biggest heist ever – it should be a wake up call for cryptocurrency users - The Conversation

The cyberattack on crypto-asset exchange Binance is potentially the largest theft of its kind on record. Binance has estimated the assets stolen at an eye-watering US$6.3 billion (£4.7 billion). On October 29, 2026, analytics firms reported that large amounts of crypto-assets had been moved from wallets used by the exchange across multiple blockchain networks – a digital system for recording transactions that is run collectively by its users. Most of the money was moved within a period of about 20 minutes.

In response, Binance temporarily suspended deposits and withdrawals telling users that it would cover losses using its emergency protection fund and corporate resources. Around US$3 billion of the affected assets was frozen by October 30, according to Binance. However, freezing funds is not the same as recovering them.

As of November 1, Binance says it has restored 95% of the stolen assets. But much of this has come from various funds held by the exchange, as well as its corporate treasury. It has now started to re-open withdrawals in phases. The exchange has promised to publish a full incident report once the investigation is completed.

Attack methodology

Investigators say that indicators point to North Korea-linked cybercriminals. But attribution should remain provisional until the evidence is fully established. The emerging explanation points primarily to a compromise of the systems that authorize withdrawals in Binance, rather than a successful attack on the underlying blockchains used for individual crypto-assets such as Bitcoin or Ether.

Binance initially suggested that an engineer's laptop had been compromised, potentially enabling attackers to access internal services and initiate unauthorized transactions. However, subsequent statements indicated that additional parts of the system had been breached. One reported element in this was Ethereum's EIP-7702 feature, which gives conventional crypto-asset wallets functions that they wouldn't normally have.

Security implications

A central lesson is that the security of a blockchain must be distinguished from the security of the wider ecosystem built around it. A blockchain may maintain a highly resilient and tamper-resistant transaction record. On the other hand, an exchange, wallet provider or other intermediary may be vulnerable.

Compromised staff credentials, defective access controls, malicious code or weaknesses in transaction approval processes can all act as entry points for cybercriminals. This also highlights that many crypto-asset services are not decentralised. Many exchanges are highly centralised in their custody arrangements, governance and control over customers' assets.

The speed and cross-border nature of the theft further complicate enforcement. Stolen assets can be moved through different blockchain networks, swapped into other tokens or channelled through decentralised finance protocols. Some issuers of a type of crypto-asset called stablecoins can freeze tokens under their control, which has helped limit losses from the Binance theft.

Regulatory response

For investors, this incident is a reminder that owning a crypto-asset involves more than exposure to its market price. There are also custody, cybersecurity, operational, and legal risks. Investors should understand who holds their assets, whether customer funds are segregated, and what security arrangements exist.

Four priorities stand out for improving security in the crypto space. First, exchanges need rigorous cybersecurity and operational resilience standards. Second, regulators should assess actual control and governance arrangements rather than accepting labels such as 'decentralised' at face value. Third, consumer protection must be strengthened through segregation of customer assets and transparent practices. Fourth, international cooperation is indispensable for tracing illicit transfers and freezing assets.

This case brings a broader message to the surface, which is that technological sophistication is not a substitute for sound governance. Confidence in digital finance will ultimately depend on the resilience of its infrastructure, the accountability of those who control it, and the effectiveness of the regulatory framework protecting users and the wider financial system.