Security Back in Spotlight After Crypto giant Binance Hit with USD 6.3 Bn Hack

Cybersecurity and cryptocurrency are back in the spotlight. 

The heart of the matter is the cyberattack on Binance – considered to be a crypto hack to date – which saw USD 6.3 billion worth digital assets getting impacted. 

“Over the past 24 hours, our teams have been working around the clock to respond to a serious security incident involving unauthorized withdrawals of funds. This is a live update on where things stand – what we’ve done, what we’ve learned, and what comes next,” Binance co-CEO Richard Teng said in a post shortly after the incident came into the light.

“Bottom line: Binance will absorb the financial impact of these stolen funds, not our users.

Over $6.34B reserved, $5B already held in the exact impacted assets. ~$3B frozen so far with our partners, Withdrawals resume once security checks are done. Then our Proof of Reserves, and a full post-mortem. We are grateful to our users for their patience and understanding,” he continued. 

Since then, Binance has begun a phased resumption of withdrawals. The company said it had replenished nearly 95% of the impacted assets. It also added that the company will absorb the financial impact of the stolen funds.” 

Binance, Crypto, Security 

Binance, also the world’s largest cryptocurrency exchange, is no stranger to security incidents. Back in 2018, Binance dodged loss of funds it quickly detected and blocked a major phishing/API-key trading anomaly. 

A year later, however, Binance suffered a major security breach where 7,000 bitcoins, then worth USD 40 million, were stolen from its hot wallet. The company, however, managed to cover 100% of the losses via its emergency insurance fund. 

In 2022, Binance reported another breach on its BSC Token Hub wherein malicious actors successfully exploited a vulnerability to mind and steal extra tokens, which is estimated to be then worth USD 570 million. 

Clearly, Binance’s losses inflated as the exchange scaled up through the years. Apart from Binance, several other crypto platforms have reported security incidents which resulted in loss of funds. 

Back in 2024, Indian exchange WazirX saw a breach which led to the losses worth USD 234.9 million. This was roughly 45% of the company’s total reserves. 

That said, security has been one of the crypto industry’s most persistent weaknesses and the financial consequences are becoming increasingly difficult to defend, according to Vikram Subburaj, CEO, Giottus. 

Chainalysis estimates that more than USD 3.4 billion in cryptocurrency was stolen during 2025. The Bybit attack alone accounted for approximately USD 1.5 billion. The latest Binance incident, at USD 6.3 billion, is larger than the estimated value stolen across the entire crypto ecosystem during that year.

“The comparison reveals an uncomfortable development. Crypto exchanges have grown into major financial institutions. So, the consequences of a single operational failure can now exceed the annual losses recorded across the industry. The problem is not necessarily the security of blockchain technology itself,” Subburaj adds. 

“Bitcoin’s underlying network, for example, is distinct from the centralised exchanges that hold customers’ assets and process their withdrawals. The weaknesses frequently arise where human judgment, software infrastructure, and custody arrangements meet. A blockchain transaction may be cryptographically valid even when the person or system authorising it has been compromised,” he continued. 

Need for Speed

One of the most concerning details about the Binance attack is the speed at which an extraordinary amount could be stolen. According to reports, it took just 20 minutes for hackers to sweep USD 6.3 billion. That averages out to USD 300 million in a minute. The speed puts several security protocols/frameworks to test. 

This is best explained by Palo Alto Networks’ Nikesh Arora who said in a post: “Attacks will accelerate from here on – We are there: Six months ago I said Mythos like capability will be widely available. It’s happening. A critical vulnerability, a social engineering attack that looks innocuous, or daisy chaining publicly available vulnerabilities and conducting a sniper strike is all being witnessed in the wild. Incident responders have never been busier.”

He also highlighted some key points to note. First up is that attacks are not becoming more sophisticated, but much faster. Second is the availability of AI-assisted cyberattacks as he points out that attack path discovery which took trial and error and several attempts are now becoming trivial. 

According to Subburaj, the immediate priority for exchanges must be to reduce the amount of money that any single compromised system can move. Keeping the bulk of customer assets in cold storage is essential, but the distinction between hot and cold wallets is only the beginning. Transaction-signing infrastructure, privileged employee accounts, and withdrawal authorisations must be independently protected. A compromised laptop or an apparently legitimate instruction should never be sufficient to initiate transfers involving hundreds of millions of dollars.

“Exchanges should introduce independently enforced withdrawal ceilings, mandatory delays for exceptional transfers and multiple layers of authorisation that cannot be bypassed through a single administrative account. Transactions involving unfamiliar destinations or abnormal volumes should trigger automatic restrictions. The system must be capable of refusing a transaction even when the instruction appears to come from an authorised employee,” he added.

Experts also note that exchanges and platforms have a financial obligation. Exchanges should maintain independently verifiable reserves and dedicated protection funds, with clear disclosure of how quickly customers can be compensated after a breach. 

The strongest security architecture is one that limits the damage even when an attacker succeeds in entering the system. 

An exchange must be designed on the assumption that some credentials, devices, and employees will eventually be compromised. The critical question is how much an attacker can accomplish before the system stops them.

Developing…