The cyber attack on the cryptocurrency exchange Binance may be the largest theft of its kind on record. Binance estimates the stolen assets at a staggering US$6.3 billion (£4.7 billion).
On October 29, 2026, analytics firms reported that large amounts of cryptocurrency had been moved out of wallets used by the exchange across multiple blockchain networks. A blockchain network is a digital system, run collectively by its users, that records transactions. Most of the funds were moved within about 20 minutes.
Binance then suspended deposits and withdrawals, and told users that losses would be covered by its emergency protection fund and its own assets. According to Binance, about US$3 billion of the affected assets had been frozen by October 30. But freezing funds is not the same as recovering them.
As of November 1, Binance says it has restored 95% of the stolen assets. However, much of that has come from the exchange's various funds and its own corporate treasury. The exchange has now begun to reopen withdrawals in stages. It has also promised to publish a full incident report once the investigation is complete.
Investigators say the indicators point to cybercriminals linked to North Korea. But attribution should remain provisional until the evidence is fully established. So how did the attackers get into Binance?
The emerging explanation suggests that the main problem was a compromise of the systems Binance uses to approve withdrawals, rather than a successful attack on the underlying blockchains used by individual cryptocurrencies such as Bitcoin and Ether.
Binance initially suggested that an engineer's laptop may have been compromised, allowing attackers to reach internal services and initiate unauthorized transactions. But later statements indicated that other parts of the system had also been compromised. It would therefore be premature to treat the laptop compromise as the whole explanation.
A useful analogy is a bank vault. If attackers can manipulate the system that tells the vault when to release money, they may not need to break the vault itself. At cryptocurrency exchanges, so-called signing infrastructure performs this approval function.
Investigators believe the attackers were able to obtain or abuse legitimate authorizations, which allowed assets to be moved from wallets controlled by the exchange. Binance says it has found no evidence that the private keys of the wallets used to authorize on-chain withdrawal transactions were leaked.
One reported element is Ethereum's EIP-7702 feature, which gives conventional crypto wallets capabilities they would not normally have. Investigators found that authorizations tied to this feature appear to have allowed code controlled by the attacker to move assets.
Those assets included funds deposited after the initial compromise. But this does not in itself prove a flaw in Ethereum's underlying consensus mechanism, the set of rules for transactions agreed upon by a decentralized network.
How secure is cryptocurrency?
The central lesson is that we must distinguish between the security of a blockchain and the security of the broader ecosystem built around it. A blockchain may maintain a highly robust, tamper-resistant record of transactions. Exchanges, wallet providers and other intermediaries, meanwhile, may be vulnerable.
Compromised employee credentials, poor access controls, malicious code and weaknesses in transaction approval processes can all be entry points for cybercriminals.
This also highlights that many crypto services are not decentralized. Many exchanges are highly centralized in their custody arrangements, governance and control of customer assets. Such concentration can create single points of failure. The decentralized nature of blockchains does not remove the need for effective governance in the firms that operate on top of them.
The speed and cross-border nature of the theft further complicate law enforcement. Stolen assets can be moved through different blockchain networks, swapped for other tokens or routed through decentralized finance protocols.
Some issuers of stablecoins, a type of cryptocurrency that works somewhat like a fiat currency such as the US dollar, can freeze tokens under their control. This helped limit the losses from the Binance theft. Cryptocurrencies such as Bitcoin and Ether generally cannot be frozen by an issuer in the same way. These differences matter greatly for tracing, recovery and investor protection.
There are also growing concerns about AI-enabled cybercrime. AI agents could increase the speed, scale and sophistication of attacks on automated financial systems. But at present, there is no established evidence that AI agents carried out this hack. Broader risks should not be conflated with confirmed causes.
Investors and financial stability
For investors, the incident is a reminder that holding crypto involves more than exposure to its market price. Custody risk, cybersecurity risk, operational risk, "counterparty risk" (an organization's exposure to another party that may fail to meet its obligations) and legal risk are also present.
Investors should understand who holds their assets, whether customer funds are segregated (that is, whether the exchange or broker is not using the crypto for day-to-day operating funds), what security and recovery arrangements are in place, and what legal protections apply if an exchange fails.
They should also not assume that crypto holdings enjoy the deposit insurance or central bank safety nets available in parts of traditional banking.
The wider implications for financial stability depend on how closely traditional banking is linked to cryptocurrencies. Traditional financial institutions are increasingly exploring the use of distributed ledger technology (a digital system for storing and sharing data across a distributed network of computers), as seen in blockchain networks, for tokenization (a data security feature), payments and settlement. Some banks also facilitate access to investments in Bitcoin, Ether and other digital assets.
Still, as financial institutions, funds and payment systems become more connected to crypto markets, operational shocks and losses may spread more widely through the system.
Practical responses
My research on crypto-assets, decentralized finance and financial regulation consistently emphasizes that innovation must come with accountability, effective governance and proportionate safeguards.
Four priorities stand out. First, exchanges need strict cybersecurity and operational resilience standards. These should include independent security testing, tightly controlled access rights, secure signing systems, transaction limits, continuous monitoring and credible plans for responding to incidents such as the Binance theft.
Second, regulators should assess the actual structure of control and governance, rather than accepting labels such as "decentralized" at face value. Entities that exercise custody or operational control should face clear obligations.
Third, consumer protection must be strengthened through segregation of customer assets, transparent custody practices, clear risk disclosures and workable insolvency and recovery arrangements. Compensation arrangements should be clearly explained rather than assumed.
Fourth, international cooperation is essential. Regulators, law enforcement, exchanges, stablecoin issuers and blockchain analytics firms must be able to work together quickly to trace illicit transfers, preserve evidence and freeze assets where legally possible.
The case points to a broader message: technical sophistication is no substitute for sound governance. Trust in digital finance ultimately depends on the resilience of its infrastructure, the accountability of those who control it, and the effectiveness of the regulatory frameworks that protect users and the wider financial system.