The $6.4 Billion Binance Hack: Tracing the North Korea Link

Black October keeps getting darker. Now $6.4 billion has vanished from Binance. Just when you thought Black October couldn't get any darker, it did. On October 29, "Binance, the world's largest cryptocurrency exchange, was hacked" (https://www.reuters.com/). According to blockchain analytics firm Chainalysis, the attackers made off with an astonishing $6.4 billion in cryptocurrencies, making this the largest crypto hack in history. For some perspective, the previous record was held by Bybit, which "lost approximately $1.5 billion in February 2025" (https://www.fbi.gov/investigate/cyber/alerts/2025/north-korea-responsible-for-1-5-billion-bybit-hack). The Binance hack is more than four times that amount. And this wasn't some obscure crypto exchange operating out of a basement. Binance is the largest cryptocurrency exchange in the world, holding enormous amounts of customer assets. The perpetrators appear to be North Korean hackers. "Chainalysis attributes the theft to TraderTraitor" (https://www.chainalysis.com/blog/binance-exploit-latest-findings-and-response/), a group linked to several previous cryptocurrency attacks. Its strongest evidence is that some of the stolen Binance funds ended up mixing with money stolen in an earlier Bitget hack, which investigators had already attributed to North Korean actors. The details of how the hackers got into Binance are still emerging. The company initially suggested that a compromised engineer's laptop may have been involved. But subsequent investigations have uncovered additional points of intrusion. Binance says it has found no evidence that wallet private keys were leaked. One of the most fascinating details, however, is what happened after the money was stolen. According to an "extraordinary investigation by Chainalysis" (https://www.chainalysis.com/blog/binance-exploit-latest-findings-and-response/), the hackers were racing against time. Some cryptocurrencies, such as Bitcoin and Ethereum, cannot simply be frozen by an issuer. But stablecoins like USDT and USDC can be. That meant the hackers had a limited window to convert the stolen stablecoins into assets that could not be frozen. In one particularly frantic sequence, the attackers moved $500 million in stablecoins into a wallet designed to convert the funds. Over roughly 20 minutes, they exchanged $325 million worth of stablecoins for around $285 million in Ethereum. Another $175 million was then moved to intermediary wallets. The goal was presumably to move faster than investigators and stablecoin issuers could freeze the money. And then things got even stranger. Chainalysis observed laundering patterns it hadn't encountered before. Thousands of transactions were taking place within a short period. Funds were repeatedly circulating between wallets, sometimes returning to addresses they had already passed through. Many of these wallets also exhibited an identical sequence: receive exactly one TRX, receive additional funds, and forward the money elsewhere. The researchers suspect that the process was automated. Think about that. The hackers had just stolen billions of dollars, and they appeared to be using an automated network of wallets to move the money around at extraordinary speed, potentially making it harder for investigators to follow. Now, it's important to distinguish between automation and artificial intelligence. Hackers have been using automated scripts and bots for decades. There is no evidence yet that AI tools were involved in this particular attack. But I'll come back to that. In the meantime, Binance and its partners have been trying to contain the damage. According to "Binance's October 30 security update" (https://www.binance.com/en/support/announcement/detail/d3306d9dca5243548c813b605e1d1751), approximately $3 billion of the stolen assets has been frozen on-chain. That is an extraordinary amount of money to freeze so quickly. But it still leaves billions outside their control. And freezing stolen funds is not the same thing as recovering them. Binance has promised to cover all customer losses. Which brings us to another interesting problem. Can Binance actually absorb a $6.4 billion loss? A $6.4 billion hole is not exactly something you can plug with the loose change lying around the office. Binance says it has set aside more than $6.34 billion in company funds, including approximately $5 billion already held in the cryptocurrencies affected by the theft. It says it's acquiring the remaining assets and will publish an updated proof-of-reserves report on November 2. That's reassuring, at least on paper. But "FT Alphaville's Bryce Elder raised an interesting question" (https://ftav.substack.com/p/binance-situation-all-fud-up) about Binance's emergency insurance fund, known as SAFU, or the Secure Asset Fund for Users. The fund was created in 2018 to protect customers against unexpected losses. Earlier this year, Binance converted the fund's holdings into Bitcoin. According to FT Alphaville, it was worth approximately $1.2 billion before the hack. There's a catch, though. FT Alphaville reports that these Bitcoin reserves are held by Nest Clearing and Custody Limited, Binance's Abu Dhabi-regulated clearing house, and are also counted towards the capital requirements of the company's Abu Dhabi operations. In other words, there's a question about how much of the emergency reserve is actually available to absorb losses without affecting other capital requirements. And the fund itself was only a fraction of the size of the hack. Binance now says it will use both SAFU and its corporate treasury to make customers whole. Whether all these assets are readily available, how the group will absorb the loss, and what the eventual impact on its financial position will be remain important questions. Then there's another problem: proof of reserves isn't necessarily proof of solvency. Showing that an exchange controls a certain quantity of crypto assets doesn't, by itself, tell you everything about its liabilities, encumbrances, or obligations elsewhere in the group. And crypto doesn't exactly have a glorious history when it comes to keeping customer money safe. As "the BBC's reporting on the hack" (https://www.bbc.co.uk/news/articles/cwe8lp7zy07zo) and FT Alphaville's analysis remind us, we've heard reassurances from crypto exchanges before. FTX is the most notorious example, although its collapse involved the misuse of customer assets rather than an external hack. To be fair, we're still in the very early days of this incident. Binance may well make everyone whole. And the speed with which billions of dollars have been frozen is an encouraging sign. But it would be premature to assume that all is well simply because the company says it is. And this problem isn't restricted to the world's largest crypto exchanges. Closer to home, India's WazirX "lost approximately $230 million in a hack in July 2024" (https://www.iimaglobal.org/sites/default/files/2025-10/WP%20No.2025-10-01.pdf), setting off a prolonged and complicated recovery process for customers. Then, in July 2025, "CoinDCX suffered a $44 million security breach" (https://indianexpress.com/article/business/coindcx-44-million-hacked-crypto-exchange-users-funds-10139256/). The company said customer funds were unaffected and that it would absorb the loss from its own reserves. These are just two Indian examples of a much wider global problem. Crypto exchanges have always been attractive targets. They hold enormous quantities of valuable, transferable assets, often in systems that operate around the clock, across jurisdictions, and with wildly varying levels of security and regulatory oversight. And the industry has had more than its fair share of spectacular security failures. Which brings me to the bigger question that's been bothering me. Is Binance the canary in the coal mine? These problems existed long before AI became mainstream. But what happens if AI makes them dramatically worse? What if AI tools make it easier to discover vulnerabilities, generate malicious code, impersonate employees, and automate complex attacks? What if techniques that previously required teams of highly skilled hackers become accessible to smaller groups with fewer resources? Or perhaps the scarier possibility is that sophisticated hackers, including state-sponsored groups, can now attempt vastly more attacks with the same resources. AI doesn't necessarily have to invent new forms of cybercrime to make cybercrime much worse. It could simply make existing techniques cheaper, faster, and easier to scale. And it isn't just the initial intrusion that matters. There's also reconnaissance, phishing, privilege escalation, transaction execution, laundering, and attempts to evade detection. If AI can compress the time and expertise required at several stages of this process, the cumulative effect could be substantial. Of course, the same technologies can be used by defenders. AI can help security teams detect anomalies, investigate suspicious activity, and respond to threats more quickly. The freezing of billions of dollars following the Binance hack also shows that the defenders aren't standing still. So the question isn't simply whether AI makes hackers more powerful. It's whether AI changes the balance between attackers and defenders, and in whose favour. I don't want to over-extrapolate from one extraordinary incident or paint an unnecessarily apocalyptic picture. There is no evidence yet that AI played a role in the Binance hack. And it would be foolish to assume that every cryptocurrency exchange is about to be compromised. But given how prevalent hacks already were before AI, I don't think it's unreasonable to ask whether things are about to get dramatically worse. And speaking of unreasonable timing, there's one final irony in this story. In the days leading up to the hack, Binance founder Changpeng Zhao, better known as CZ, had apparently been "warning about vulnerabilities in crypto software and the dangers of phishing" (https://ftav.substack.com/p/binance-situation-all-fud-up). He wasn't wrong. But boy, oh boy, the timing. And in a profoundly ironic development, Chainalysis itself was the result of a hack, and some customer data was stolen in the event (https://www.chainalysis.com/blog/security-incident-october-30/). What makes all of this even more surreal is the pace at which things seem to be happening. Every time I think I've caught up with one extraordinary development, another three have appeared. And by the time I understand those, five more seem to be unfolding somewhere else. Reality suddenly seems to be running at 3x or 4x speed, while this roughly three-pound lump of pinkish-grey meat inside my skull can barely process things at 0.2x or 0.5x. What a crazy world we've entered. B.