Industry experts assert that the Binance hack, amounting to a record $6.3 billion and becoming the largest cryptocurrency theft globally, demonstrated operational weaknesses in crypto exchanges rather than any issues with the blockchain technology itself.
The world's largest cryptocurrency exchange estimated the total alleged damage at approximately $6.3 billion, which is four times the amount stolen during the previous record—the Bybit hack. About $3 billion in assets that passed through wallets linked to hackers were identified and frozen. The exchange promised to cover all incurred losses.
Binance reported that initial investigations pointed to a compromised DevOps engineer's laptop, which allowed the attacker access to a service container and sent unauthorized withdrawal transactions. Later, the exchange clarified that further study uncovered additional points of entry, contradicting the initial finding of a single compromised laptop. However, the exchange stated it found no evidence of private wallet key leakage.
The UAE financial services regulator overseeing the Abu Dhabi Global Market stated that it is aware of the incident and is monitoring the situation. Binance confirmed that it has allocated over $6.34 billion from its own funds to cover the consequences of this incident.
Georgy Kucherin, Senior Security Researcher at Kaspersky GReAT, noted that the attack on Binance and a separate incident on the Polymarket prediction platform involving a compromised script from third-party developer DebugBear prove that exchanges can be hacked both through internal systems and external dependencies. He added that technical personnel remain the weak link, as even experienced engineers can inadvertently upload malware.
Sandip Pyapali, founder and CEO of Mesta, suggested that the attacker likely used the exchange's own access channels. He believes that if the hacker gained privileges through an employee's device, the system might have accepted the withdrawals as legitimate. Pyapali characterized the event as a 'maturity test' for the crypto industry, not a catastrophe, noting that exchanges will now require more robust safeguards, deeper insurance, and larger reserves.
Karsten Menke, Head of Next Generation Research at Julius Baer, stated that this incident is a 'company problem, not a crypto problem,' thereby highlighting the risks of holding assets on centralized exchanges. He recommended using self-custody in offline cold storage to reduce risk exposure. Menke also mentioned that there is no evidence of AI involvement in the attack, but noted that AI reduces the cost and speed of sophisticated attacks. He cited industry estimates that one of four malicious attacks now utilizes AI, reiterating Julius Baer's constructive view on cybersecurity.
Vincent Choc, CEO and Founder of First Digital, noted that the past day showed how crucial coordination between exchanges, issuers, and networks is when they exchange information within hours. Sergey Kunts, co-founder of 1inch, reported that Tether and Circle froze over $2.4 billion in stablecoins, and other teams blocked addresses associated with the exploit. According to him, this 'significantly limited' the attackers' ability to move funds.
