For years, the crypto industry has tried to shed its affiliation with crime while marketing itself as a safe alternative to traditional banking and investing. But once again, a record-shattering heist is deepening concerns about crypto’s vulnerabilities.
On Thursday, the world’s biggest crypto exchange, Binance, saw more than $6 billion siphoned from its system in the span of about 20 minutes. About half of those funds were linked to a kind of cryptocurrency known as stablecoins, which were quickly frozen by the firms that issue them. The other funds were tied up in digital tokens such as bitcoin and ether, which don’t have centralized governing authorities and are likely impossible to recover, according to crypto researchers.
World’s largest crypto exchange hit by suspected North Korean hack in world’s largest heist
Binance’s losses could top $3 billion, according to researchers. The company pledged to cover the losses with emergency reserves and other assets. Binance emphasized that “user funds are safe” and said it expects to resume withdrawals by Sunday morning.
Binance suspended deposits and withdrawals Thursday, just hours after a smaller security breach throttled operations at Polymarket, the crypto-powered prediction market. This was the second apparent hack of Polymarket since June and was likely unrelated to the Binance incident.
Some 700 Polymarket users lost $2.7 million in unauthorized withdrawals, according to analytics firm Bubblemaps . Like Binance, Polymarket promised to make customers whole.
But security experts warn that covering customer losses isn’t much of a long-term strategy.
“The fact that Binance may have the balance sheet to absorb the damage is encouraging, but I wouldn’t confuse financial strength with operational security,” Ryan Kirkley, CEO of crypto infrastructure firm Global Settlement Network, said in an email.
“We’re talking about the world’s largest crypto exchange relying on emergency freezes and reimbursement promises,” he said. “That’s a serious problem for an industry asking institutions to trust it with substantially more capital.”
To be sure, any business can be vulnerable to a cyberattack. But centralized exchanges like Binance have become high-value targets for hackers, in part because they exist outside the strict regulations that banks and other financial institutions must adhere to. And crypto has long been favored by criminal enterprises because it can move funds quickly and anonymously across borders.
Binance, which was founded in China but lacks a fixed headquarters, pleaded guilty in 2023 to violating US federal anti-money-laundering rules, among other charges — a case that landed its founder, Changpeng Zhao, in prison for four months. Zhao was pardoned by President Donald Trump last year but remains legally prohibited from running Binance.
AI is turbocharging security risks across the internet.
In Thursday’s Binance hack, researchers at Chainalysis said they observed “laundering patterns we have not seen before” and that “thousands of transactions in a short period suggest that the attackers are using automation to obscure the trail of funds .”
And despite a warm embrace from the Trump administration, crypto remains a risky business with few regulations on the books. In the United States, the vast majority of people investing in crypto do so through centralized exchanges that lack the kind of federal deposit insurance provided by traditional banks.
“Centralized exchanges pose a risk because they’re centralized… once that system gets hacked, everybody’s funds can be compromised,” said Iman Shafiei, founder of Keystone Research Group, in an email.
The simplest protection, he said, is to not leave funds sitting on the same exchanges where you buy and sell. “The moment you want to hold, move your crypto to a self-custody wallet.”
Of course, self-custody, in which a person manages their own digital wallet, comes with its own potential headaches. If an account holder loses their password, there is no customer service hotline to call and those funds are effectively gone. In 2021, Chainalysis estimated that around 20% of all the bitcoin ever created may be lost or stranded in wallets that account holders can no longer access.
