Security, fraud, custody and markets specialists who sent reaction to The Fintech Times agree on the lesson, and most of them say it is not only crypto’s to learn.

Attackers drained Binance hot wallets on ten blockchains on the afternoon of 29 October, US Eastern time. Blockchain intelligence firm TRM Labs puts the total at about $6.36 billion and links the attack to North Korea, as does Chainalysis. That is more than four times the previous record, the roughly $1.5 billion taken from Bybit in February 2025.

Binance’s initial investigation pointed to a compromised DevOps engineer’s laptop that gave the attacker access to a service container, from which unauthorised withdrawal transactions were submitted. The exchange said it found no evidence that a wallet private key had leaked. Stablecoin issuers moved quickly: Tether and Circle froze around $3 billion of the stolen funds.

Binance suspended deposits and withdrawals for about 45 hours, pledged to cover all losses from its Secure Asset Fund for Users and its own balance sheet, and by 1 November said it had replenished about 95 per cent of the affected assets. When withdrawals reopened on 1 November, customers took out $4.65 billion against $1.01 billion of deposits in the first nine and a half hours, a net outflow of $3.64 billion, according to figures reported by CoinDesk. Binance published a fresh proof of reserves snapshot on 2 November and has scheduled another for 4 November. Bitcoin fell below $80,000 as the news spread and was trading around $77,000 on 2 November.

For Nauman Abuzar, VP of risk and compliance at fraud prevention firm SEON, the point of entry is the story. “Once the attacker gained that access, the transactions appeared valid to the systems processing them, and funds moved across multiple blockchains in minutes. That leaves very little time to intervene,” he said. “Controls that only kick in once a transaction starts may already be too late. Teams need to identify compromised access early, whether that’s a new device, an unusual login pattern or an employee account suddenly behaving differently, and connect those signals to what is happening with the funds.”

Javvad Malik, lead CISO advisor at KnowBe4, said the most catastrophic breaches “rarely exploit exotic zero-days in core protocols, but instead hinge on privileged access failures.” His prescription: “Leaders need to build walls between everyday work laptops and core financial systems, require multiple independent people to sign off before large amounts of money can leave the building, and set automatic spending caps that immediately freeze suspicious, high-volume transactions before the damage is done.”

Chris Dimitriadis, chief global strategy officer at ISACA, the professional body for digital trust, put it more bluntly, calling the attack “a stark reminder that you can spend a fortune protecting your most critical systems, but if just one device is compromised, then your security is only as strong as the weakest machine on the network.” Organisations holding high-value assets, he said, “must assume a breach will happen and plan for it ahead of time.”

Georgy Kucherin, senior security researcher at Kaspersky‘s Global Research and Analysis Team, said technical staff at exchanges remain a favoured route in, and that “even experienced engineers and developers can become victims of cyberattacks and, in some cases, inadvertently download malware.” He cautioned that North Korea’s Lazarus group is among the suspects but that its involvement “remains under examination and final conclusions can only be drawn once the investigation is complete.”

Stefan Deiss, CEO of The Hashgraph Group, a Swiss identity infrastructure company, called it an identity problem rather than a crypto one: “once a system believes you are someone it trusts, it lets you act.” He drew the parallel with the attempt by North Korean hackers to move nearly $1 billion out of Bangladesh’s central bank in 2016, after which banks tightened controls “so that no single login can move large sums without independent checks. Crypto has grown so quickly that its security has focused on protecting the blockchain itself, while controls around the people and systems inside the business have been slower to catch up.”

Several respondents said traditional finance should not treat this as someone else’s problem. Deep Patel, partner and UK payments lead at consultancy Capco, noted that “many mainstream financial services organisations are in the midst of delivering exchange and wallet capability, and will no doubt now be taking a moment to pause and review cybersecurity designs and controls.”

Analysts at GlobalData said attackers “are increasingly seeking to exploit the trust embedded within financial infrastructure, turning legitimate access and transaction processes into mechanisms for moving money.” Its Wealth Management Industry Conditions Analytics 2026 survey of 478 wealth managers found 65 per cent rank cybersecurity as their greatest threat, up from 56 per cent in 2025. “Banks must assume that some defenses will eventually fail and design their operations to prevent a single compromise from becoming a financial catastrophe,” the firm said.

Dan Holmes, VP of product planning and strategy at Feedzai, framed it as a trust test for banks moving into digital assets: “While at the moment they are still two different realms, they are targeted by similar attacks. Finance is built on trust: if traditional banking can’t deliver it when it comes to crypto, it won’t work.”

Custody specialists read the same facts as an argument for spreading control. Artem Stopnevich, CEO of The Vault, an EU and Swiss regulated digital asset custodian, said institutions “need direct control over signing systems, access policies and transaction approvals” and that, for custodians, “the challenge is to make sure that compromising one operational system is not enough to move funds.”

Andrew Lazutkin, CTO of self-custody wallet maker Tangem, said the incident shows how custodial models concentrate risk. “With self-custody, users retain direct control of their private keys. When funds are properly secured in an offline wallet, an exchange breach alone does not give attackers access to them,” he said, while conceding that self-custody “does not eliminate risks such as phishing or malware.” Tangem’s own survey of crypto users found 66 per cent consider self-custody important but only 15 per cent use cold wallets.

Binance says the losses are covered. Varun Datta, founder and CEO of Web3 investor Truth Ventures, said the theft is only half the pressure. After Bybit lost about $1.5 billion in 2025, it processed around $4 billion of withdrawals. “After a major exchange hack, I would watch how much customers withdraw as closely as how much was stolen,” he said. He also warned about what an emergency fund holds: “If an exchange owes customers $1 billion in stablecoins and holds $1 billion in Bitcoin to cover a loss, a 10% Bitcoin fall leaves it $100 million short unless it adds more money.”

Ed Goh, head of trading at liquidity provider B2C2, said volumes and liquidity returned to normal levels once withdrawals resumed. “The question now is whether that recovery holds and trading activity remains stable over the coming weeks,” he said, pointing to perpetual futures open interest relative to rival exchanges as the signal to watch. “For now, Binance Futures remains one of the dominant liquidity pools among centralised exchanges.”

About half the haul was frozen, which leaves roughly as much in the attackers’ hands or already moving. Jonathan Benton, founder of crypto asset recovery firm iSanctuary and a former senior UK law enforcement officer, said: “The technology exists to trace stolen funds; however, the challenge is turning that intelligence into rapid, coordinated action before those assets disappear. It needs to be part of the infrastructure.”

B2C2’s head of funding, Mark Jones, described how stolen USDT was taken to lending platform Aave and swapped into ETH, which cannot be frozen at the issuer. “Aave wasn’t hacked. Instead, the exploiter used its normal lending functions,” he said. “That’s why containment has to happen as early as possible, and at the token level, which is far more targeted than the platform level.”

In Westminster, the co-chairs of Parliament’s Crypto and Digital Assets APPG, Lord Vaizey of Didcot and Gurinder Singh Josan CBE MP, called on the UK government to work with international partners “to trace and freeze the remaining funds, disrupt money laundering and identify and sanction those responsible,” and for the National Crime Agency and National Cyber Security Centre to share the lessons with UK businesses. “The immediate priority must be to stop North Korea benefiting from this theft and prevent further attacks.”

Security specialists expect criminals to exploit the confusion. NordVPN warned customers on every platform to watch for “an email claiming your funds are at risk, a fake support account offering help or a message urging you to move your cryptocurrency to a ‘safe wallet'”, and to check updates only through the Binance app or a website they already trust. ISACA’s Dimitriadis agreed that high-profile incidents “are often exploited by hackers on other platforms to trick users into taking immediate action that could compromise their crypto assets.”

Regulation is likely to follow. In the UK, Capco’s Patel said the hack “puts emphasis on implementation of improved regulations such as the UK’s new Cryptoasset Regime,” while noting that even under the new rules “there is currently a lack of a of FSCS-like measures.”

iSanctuary’s Benton offered the verdict the industry will be judged on: “The future of crypto won’t be decided by how much money enters the market, but by how safe that money is once it’s there.”

AI level 2 of 5: drafted by our AI editorial assistant from published sources our editor selected, linked in the piece; fact-checked, edited and signed off by Mark Walker, Editorial Director. What the levels mean

Author

  • Disrupts Media

    Rowen Brooks is an AI staff writer at Disrupts Media, the publisher of The Fintech Times, The Biotech Times, The Datatech Times and Disrupts. She reports across all four titles, covering financial technology, biotechnology, data and the wider field of emerging technology. Her work spans news, interviews, commentary round-ups and explainers, with a focus on how new technology is built, funded and adopted, and what it means for the businesses and people using it. She can be reached at [email protected].

    View all posts Staff Writer

Rowen Brooks is an AI staff writer at Disrupts Media, the publisher of The Fintech Times, The Biotech Times, The Datatech Times and Disrupts. She reports across all four titles, covering financial technology, biotechnology, data and the wider field of emerging technology. Her work spans news, interviews, commentary round-ups and explainers, with a focus on how new technology is built, funded and adopted, and what it means for the businesses and people using it. She can be reached at [email protected].