Since the Oct. 29 Binance hack, crypto companies and security experts have been grappling with what the future might look like for digital asset security.
Seeing most of $6.3 billion disappear in a mere 20 minutes will do that.
Many in the industry agree that mistakes were made, but also recognize that this could have happened to others — and will if digital asset infrastructure doesn’t get hardened and intelligence isn’t shared.
By now the basic details are well known: Hackers who were identified by the FBI as North Korean state-sponsored actors had made their way into Binance’s systems. Once there, Binance says they put in a malicious script, compromised the infrastructure that authorizes outgoing transactions and gave themselves the ability to send money out without going through the regular withdrawal process.
Photo by Egor Komarov on Unsplash
About $2.85 billion of the stolen funds was frozen or intercepted, and Binance said it will absorb the losses rather than pass them to customers. The rest, however, will now be closely monitored to see where it ends up next.
Giuseppe Fersini, head of intelligence at Elliptic, a blockchain analytics firm, compared the attack to the 2025 hack of crypto exchange Bybit. That theft, which was also attributed to North Korean actors, again had targeted a developer machine.
“The attacker gained access that let them have legitimate systems approve illegitimate transactions. That shifts the question from ‘are our keys safe?’ to ‘What can anyone with access to our systems get signed,’” Fersini told Financial News Network. “That is a challenge for the whole industry, not one company.”
Limit What Any One Credential Can Do
The hack still raises the question for customers on what option is safer for their funds, and what custody model makes the most sense security wise. As seen with the Binance hack, centralized custody could be infiltrated – but self-custody still carries its own risks.
Hannah Arnold, COO of digital-wallet infrastructure company Turnkey, noted in a recent appearance on FNN’s studio show that there’s inherent risk in keeping “lots of valuable stuff” in one place. That’s especially true if the authorization or access layers aren’t well separated.
“The argument around cryptocurrency exchanges or centralized custody is: honeypot is dangerous, and it is. But there are lots of different ways to set up that central pool of assets,” Arnold said, adding that companies can include checks and multiple approvals around what any single credential can do.
AI Changes the Playbook
The use of AI by criminals is quickly becoming a main focus for cybersecurity experts concerned that the tools will make sophisticated attacks more common.
AI shows up twice in Binance’s account of the attack. In June, according to the exchange’s initial report, an engineer “downloaded a tampered Homebrew installation” so they could install an AI coding tool. In October, the report says, the attackers used an internal AI tool to gain control over two other wallet engineers.
“You need to rebrand your security team as a defense factory,” Anto Joseph, a blockchain security engineer at blockchain infrastructure and research company Eigen Labs told FNN. “Otherwise, the way we did security before AI is just not gonna work where we are going.”
Binance’s post-mortem on the hack outlined the steps it was taking to beef up security, including investing more in AI security and prevention, enhanced AI-based anomaly detection and strengthened risk controls. The exchange also said it rebuilt the wallet system and AI tool used in the hack.
“Could this have been stopped? Of course it could have been stopped,” TRM Labs Head of Global Policy Ari Redbord told FNN. “North Korea is continuing to poke and prod at every crypto firm to see if they can find vulnerabilities.”
One bright spot in the hack was how quickly other crypto companies swooped in to assist Binance, from Coinbase offering its help to stablecoin issuers Circle and Tether quickly freezing funds. Still, TRM said the attacker converted some into assets beyond any issuer’s reach and still held about $2.4 billion as of Oct. 30.
Photo by Vadim Art on Unsplash
Sharing intelligence, security experts say, is one major way the industry can step up their protection measures against hard-hitting hacks.
“Collaboration produced the fastest results in this case,” Fersini said. “Regulation matters too, because it sets the minimum everyone has to meet.”
The Clarity Act — which failed to advance in the U.S. Senate — outlined some measures meant to combat fraud and address AML needs in the digital asset space. But the fate of any future digital asset legislation is now very much up in the air, particularly after midterm election results.
Is Crypto a Special Case?
Binance wasn’t the only financial institution to be victimized recently. French bank Credit Mutuel Arkea said Wednesday that hackers infiltrated its systems, with thieves stealing around €100 million (or $113 million) in the cyber heist, according to Reuters. The bank said the attackers reached it through a service provider’s platform and used its own account to send money to other banks, which may have let them convert it to cryptocurrency.
Crypto is different, and we have to recognize that
TRM’s own tracking showed most of the funds left Binance in about 20 minutes.
Arnold, the Turnkey executive, sees the problem as broader than crypto. It’s hitting the open internet and companies of all kinds, banks included, she said.
“There can be errors anywhere along the chain, and if I think this reinforces anything, it’s just we are in a security apocalypse right now.”
