Surprisingly Useful AI Article Enhancements
Cryptocurrency exchange, Binance, is racing to recover funds after hackers made off with approximately $6.3 billion in digital assets in a breach that has rattled crypto markets and drawn the attention of law enforcement agencies worldwide.
The company, which handles more trading volume than any other crypto exchange and claims more than 300 million registered users, has frozen roughly $3 billion of the stolen assets so far. Binance has pledged to cover all customer losses from its own reserves, including the Secure Asset Fund for Users (SAFU) and additional company funds totalling more than $6.34 billion.
How the breach unfolded
Blockchain analysis firms, TRM Labs and Chainalysis, have reported that the bulk of the theft took place in approximately 20 minutes, with attackers draining funds across 10 blockchains. Some 30 to 40 different tokens were affected, including Ethereum, Bitcoin and stablecoins.
Binance’s Co-CEO, Richard Teng, indicated the breach initially appeared to have originated from a compromised laptop belonging to one of the company’s DevOps engineers, which gave an attacker access to a service container where they submitted unauthorised withdrawal transactions.
Teng has since acknowledged that the attack was broader than first understood.
“This was not carried out by one person,” Teng explained, adding that subsequent investigation had uncovered “additional points of breach.”
The attackers employed sophisticated countermeasures, including what Teng described as a self-destruct mechanism that destroyed tooling and traces as they moved through systems, complicating forensic efforts.
Raghu Nandakumara, Vice President of Industry Strategy at cybersecurity platform, Illumio, suggested this could mean an engineer was socially engineered into running a test, during which malware was deployed onto their laptop. Because the device already held sufficient security privileges, it became the attacker’s route into production systems and from there to the wallets.
Dr Clive Summerfield, Head of FARx, a biometrics in AI security company, observed: “You can build a vault with mathematical firewalls, but if the individual holding the keys can be duped, the vault is opened.”
Binance has stated it found no evidence of any wallet private key leakage. However, Mark Karpeles, former Head of the collapsed Tokyo exchange, Mt Gox, told Reuters he believed the attackers had probably accessed keys for at least two Binance wallets.
North Korea’s TraderTraitor unit suspected
Multiple analytics firms have pointed to North Korea as the likely source of the attack, though Binance itself has not attributed responsibility.
TRM Labs reported it had assessed with “high confidence” that the attack was carried out by TraderTraitor, an elite North Korean hacking unit linked to the Lazarus Group. The firm noted the attack mirrored a $1.5 billion heist at crypto exchange, Bybit, in February 2025, which the FBI attributed to the same unit.
Chainalysis reached the same conclusion, adding that its investigators had traced funds being laundered and shuffled in an automated process designed to obscure the trail.
“When North Korea steals at this scale, the money funds weapons proliferation and other destabilising activity,” TRM’s Global Head of Policy, Ari Redbord, told Al Jazeera. “That makes this a global security issue, not just a crypto theft.”
North Korea routinely denies involvement in hacking operations, but experts have long documented the regime’s reliance on cybercrime to generate foreign currency. A UN panel of experts reported in 2024 that it was reviewing 58 suspected cyber-attacks by North Korea on cryptocurrency-related companies between 2017 and 2023, valued at roughly $3 billion. The panel estimated the stolen funds generate around half of North Korea’s foreign currency income.
Related: Best Business Laptops for work & school
Related: Best Gaming Laptops
Related: Best Portable Laptop
Dr Edward Howell, a North Korean Foreign Policy Expert at the University of Oxford, told the BBC that Pyongyang “has a long history of using cyber warfare to extract cash” and maintains what amounts to a state-run cyber warfare agency used to fund its weapons programmes.
Ciaran Martin, a former Head of the UK’s National Cyber Security Centre, argued that North Korea has targeted crypto because traditional banks have developed defences that the fast-growing and lightly regulated crypto sector has yet to match.
Law enforcement mobilises
The US Secret Service confirmed it is working to identify, freeze, trace and recover stolen funds and to identify those responsible.
The FBI acknowledged it is engaged with public and private partners to understand the scope of the activity and coordinate investigative steps.
In the US, Commodity Futures Trading Commission Chairman, Michael Selig, told reporters it was “very concerning” that there had been several cyber incidents involving crypto, adding that the regulator has the ability to trace blockchain transactions.
The UK’s financial watchdogs are also monitoring for potential fallout from the incident.
Stablecoin issuers, Tether and Circle, have frozen more than $2.3 billion of the affected assets, according to Reuters. However, TRM Labs estimated roughly $3.4 billion worth of crypto remains out of reach, with Binance warning the total figure “may continue to increase” as tracing efforts continue.
Binance’s financial exposure
Binance has no cyber insurance and will fund customer reimbursements entirely through company reserves, according to a source close to the exchange who spoke to Reuters. The source described crypto cyber insurance as “virtually impossible” for crypto companies to obtain.
The exchange does hold directors’ and officers’ liability insurance, which could respond to claims against executives alleging oversight failings, rather than replacing stolen assets. The source confirmed Binance’s SAFU fund has no external insurance or reinsurance backing.
Relm CEO, Joseph Ziolkowski, told Reuters the hack could mark an “inflection point” for digital asset insurance buying, with firms needing to look beyond large specie limits and examine the breadth of their protection. He described the industry’s historical approach as “form over function.”
Ed Lewis, Global Lead for Cyber and Technology Risks at law firm, RPC, cautioned that a cyberattack “tells you how the trouble started. It does not tell you which policy pays for the missing money.”
Lewis added that frozen assets had not necessarily been returned, and that customer reimbursement did not establish that an insurer was paying.
Several legal experts have warned customers not to regard Binance’s promise to cover losses as legally binding. Daniel Tunkel, of London-based law firm, Edwin Coe, noted that any dispute would come down to what customers have been promised in their contracts and where Binance can be pursued for non-performance.
Market fallout
The hack sent shockwaves through cryptocurrency markets. Bitcoin fell around 5 per cent to approximately $77,000, down from more than $86,000 earlier in the month. Ethereum dropped more than 6 per cent to around $2,200 at its low, while Binance’s native token, BNB, shed 6.5 per cent. Solana declined 7.7 per cent.
Crypto-related stocks were also hit. Coinbase dropped 12.7 per cent despite reporting quarterly results that beat analyst expectations. Strategy, which holds about 4 per cent of the total Bitcoin supply, fell 6 per cent. Robinhood slipped 7.8 per cent.
The broader US stock market was already under pressure from disappointing earnings at Intel and Amazon, which amplified concerns about AI-related spending. The S&P 500 lost 1.8 per cent, while the Nasdaq Composite fell 2.84 per cent in its steepest one-day drop since June. The Dow Jones Industrial Average declined 1.09 per cent.
Sean Foley, a crypto markets expert at Macquarie University in Sydney, told Al Jazeera that any assets held at a centralised exchange are only as safe as the exchange itself, and the larger an exchange’s holdings, the larger a target it becomes.
Questions over crypto security
The breach has renewed scrutiny of the security of centralised crypto exchanges.
Jennifer Craven, an International Commercial Fraud Expert at law firm, Pinsent Masons, warned the repercussions could extend well beyond Binance.
“If a platform as sophisticated as Binance can suffer a serious attack, regulators will inevitably ask what that means for smaller, less mature platforms and currencies,” Craven cautioned.
She predicted the attack would accelerate scrutiny of how the sector protects both its infrastructure and its customers, and noted that while there is no evidence AI was used in this particular attack, it fits into a broader concern about whether AI agents could identify and exploit software weaknesses faster than human hackers.
The Bank of England has previously warned this dynamic could leave institutions struggling to fix vulnerabilities before attackers act on them.
Troublingly, the stolen sum dwarfs Binance’s Secure Asset Fund for Users (SAFU), the emergency reserve established in 2018 and converted entirely to Bitcoin earlier this year. The fund holds approximately 15,000 BTC, purchased at an average price of around $67,000 and currently valued at roughly $1.15 billion – less than a fifth of the total theft. The fund does have a rebalancing mechanism: if the fund’s market value falls below $800 million due to BTC price fluctuations, Binance will rebalance the fund to restore its value to $1 billion. However, the scale of the current hack challenges the (solo) effectiveness of the fund. That said, in many ways, Binance could still be regarded as being more robust than a bank owing to its (claimed) 1:1 customer reserve ratio versus typical banks leveraging 90 per cent of customer funds. More on that in a forthcoming article.
This is not the first time Binance has been targeted. Hackers stole $40 million worth of Bitcoin from the exchange in 2018, and a further $568 million in coins were affected in a separate 2022 incident.
More broadly, hackers stole $2.87 billion in crypto across nearly 150 attacks in 2025 alone, according to TRM Labs’ 2026 Crypto Crime Report.
What Binance users should do
NordVPN’s Chief Technology Officer, Marijus Briedis, warned users to be on the lookout for phishing attempts exploiting the situation, including emails claiming funds are at risk, fake support accounts offering help, or messages urging users to move cryptocurrency to a “safe” wallet.
“Check updates through the Binance app or a website address you already trust,” Briedis recommended. “Avoid links in unsolicited messages, and never give anyone your password, verification codes or wallet recovery phrase.”
Binance has confirmed that deposits remain unaffected but withdrawals were temporarily suspended as a precaution while the company completes a security review. The company indicated it expected to resume withdrawals within 45 hours.
Teng pledged: “We will do everything in our power to make sure that these bad actors are held accountable.”
Binance has urged users to follow official channels only for verified updates, warning that anyone contacting users claiming to be Binance and requesting passwords, one-time passcodes or seed phrases is running a scam.
Last Updated on October 31, 2026 by Nick Ross
