Binance’s $6.3 Billion Hack Exposes New Risks for Crypto Security

Binance’s preliminary investigation into its October 30 security breach found no evidence that wallet private keys had been exposed.

The company reported a suspected compromise of an engineer’s laptop and subsequent unauthorised access to an internal service used to submit withdrawal transactions.

Binance said approximately $3 billion in affected assets had been frozen on-chain and pledged to cover customer losses through its Secure Asset Fund for Users (SAFU) and company funds.

The exchange temporarily suspended deposits and withdrawals while working with law enforcement to trace the transfers. It has not released a final accounting of recovered assets or customer losses.

The investigation has not established whether the attacker gained transaction-signing authority or exploited existing permissions within Binance’s withdrawal system.

Binance Withdrawal Requests Raise Questions About Transaction Approval

Bitquery traced unauthorised transfers from 17 Binance hot wallets across nine blockchains between 20:04 and 23:56 UTC on October 29.

The transactions carried valid cryptographic signatures, although some differed from the exchange’s normal activity.

Bitcoin transfers paid roughly twice the usual fees, while those on TRON and the XRP Ledger used settings researchers had not observed in Binance’s other transactions that night.

Bitquery also identified 50 signed Ethereum authorisations involving EIP-7702, which allows accounts to delegate execution to smart-contract code.

One hot wallet reportedly operated under attacker-controlled code for nearly four hours. The findings do not establish how the transactions were initiated within Binance’s systems or whether its signing permissions were compromised.

In February 2025, attackers stole approximately $1.5 billion from Bybit after compromising a Safe wallet developer’s credentials and altering the transaction interface.

Bybit employees approved what appeared to be a routine transfer, allowing the attackers to redirect the funds. A forensic investigation found no evidence that Bybit’s own infrastructure had been breached.

Digital-asset custody provider Fireblocks allows institutions to restrict withdrawal destinations and require additional approval for transactions based on user permissions and transfer amounts.

Its security policies can also require multiple administrators to authorise sensitive wallet changes.

AI Cyberattacks Automate Intrusions Into Corporate Systems

Anthropic reported in November 2025 that attackers used Claude Code in a cyber-espionage campaign targeting approximately 30 organisations, including technology companies, financial institutions and government agencies.

AI performed an estimated 80–90% of the tactical work, according to the company’s investigation, while human operators selected targets and authorised key decisions.

Anthropic attributed the operation to a Chinese state-sponsored group. No connection to the Binance breach has been established.

In a separate investigation published in September 2026, Anthropic described financially motivated attackers using automated agents to search for software vulnerabilities and obtain credentials.

One group compromised an AI provider’s evaluation environment, stole production API keys and used them in further attacks. The report also identified phishing operations targeting identity-verification sessions.

Nigeria’s national computer emergency response team reported in June that attackers suspected of gaining privileged access to card-authorisation infrastructure were linked to more than $2 million in fraudulent withdrawals at United Bank for Africa’s Senegal operation.

The activity involved 3,421 ATM transactions. Authorities did not establish AI involvement.

Bank of Ireland reported in June that its AI-based payment monitoring system, developed with Visa-owned Featurespace, had reduced attempted payment fraud by 30% and customer losses by 25% since implementation in 2024.

Crypto Exchange Security Brings Asset Recovery and Custody Into Focus

Following the Binance breach, Bitquery’s October 30 analysis identified approximately $2.7 billion in assets frozen by Tether, Circle, Arbitrum and smaller token issuers.

Tether restricted about 1.76 billion USDT, while Circle blocked 823 million USDC. Another $729 million in USDT had been exchanged for other cryptocurrencies before the restrictions took effect. Bitquery did not report that the frozen holdings had been returned to Binance.

A US securities filing covering custody arrangements with Anchorage Digital Bank disclosed insurance limits of $100 million for specified theft and computer-fraud losses and $1 million for cyber and technology errors and omissions.

The limits apply to the coverage described in that filing, subject to its policy terms. Anchorage is a federally chartered digital-asset custodian supervised by the Office of the Comptroller of the Currency.

Binance plans to publish an updated proof-of-reserves report after completing security remediation. CoinDesk identified affected hot wallets in the exchange’s October reserve snapshot, although the effect on customer backing has not been established.

The Public Company Accounting Oversight Board has warned that proof-of-reserves reports are not financial-statement audits and provide no assurance about the effectiveness of a custodian’s internal controls.

In May 2025, the OCC confirmed that national banks could provide cryptocurrency custody and execution services through third parties, provided they maintained appropriate oversight. The banks remain responsible for managing the risks of outsourced custody arrangements.

Digital Dollar Growth Brings New Security Obligations for Financial Institutions

On September 24, the Federal Reserve proposed rules for dollar-backed payment stablecoins under the GENIUS Act. Issuers subject to its supervision would have to maintain reserves in eligible assets, including short-term US Treasury bills, and hold capital against credit and operational risks.

The proposals include requirements for safeguarding reserve assets. Public comments are due November 30, 2026, and the regulations have not been finalised.

U.S. Bank announced on September 9 that it had completed a cross-border payment using USBDC, its proprietary dollar-backed stablecoin.

The transaction moved between its North American and European entities on the Stellar blockchain, using the bank’s existing compliance and risk systems. U.S. Bank described the transaction as a pilot.

USBDC, Tether’s USDT and Circle’s USDC are privately issued dollar-linked tokens. The Federal Reserve has not issued a central bank digital currency, and a January 2025 executive order restricted federal agencies from developing or promoting one, except where required by law.

Federal Reserve Governor Michael Barr warned in September that stablecoin holders must be able to redeem their tokens at face value during financial stress.

Issuers must therefore maintain sufficient accessible reserves to meet redemption demands. Banks and payment companies offering tokenised payments also face responsibility for securing customer transactions and protecting assets held on their behalf.