Opinion
The $6.3 billion Binance hack should change how we think about cybersecurity
"The Binance hack may be remembered for the billions that were stolen," writes Blockaid CEO Ido Ben-Natan, "but its longer-term impact could be the changes it forces across the financial industry."
Last week, hackers stole an estimated $6.3 billion from Binance in what is believed to be the largest crypto theft in history, more than four times the $1.5 billion stolen from Bybit in February 2025. But the most troubling part of this attack wasn't the amount stolen. It was how the hackers managed to move billions of dollars through transactions that appeared legitimate. I believe this attack will mark a turning point for the financial industry, forcing institutions to rethink how they protect digital assets and putting greater emphasis on preventing fraudulent transactions before they happen.
The attack began on October 29, when hackers drained approximately $2.5 billion from one of Binance's largest Ethereum hot wallets in a single transaction. Within the next 12 minutes, ten additional hot wallets across multiple blockchains transferred funds to the same address. The speed and scale of the attack left little time for anyone to intervene.
At Blockaid, we detected the first signs of the attack less than two minutes after the initial transfer and began tracking the stolen funds across multiple blockchains. Blockaid has published that tracking as a live map, so any organization can see where the funds are and check its own addresses against those tied to the attack. But even detecting an attack that quickly doesn't necessarily mean it can be stopped. By the time security teams respond, the funds may already be gone.
The hackers targeted the systems responsible for approving transactions, rather than the blockchain itself. By gaining control of the signing infrastructure, they were able to authorize transfers worth billions of dollars that appeared legitimate to the network. The blockchain can verify that a transaction was signed with the correct credentials, but it cannot determine whether those credentials are being used by their rightful owner or an attacker.
For years, much of the conversation around crypto security has focused on protecting private keys, the digital credentials that control cryptocurrency wallets. That remains essential, but the Binance attack showed why it isn't enough. Once attackers gain control of a system authorized to move money, they can use that authority to carry out fraudulent transactions without breaking the underlying technology.
This is where I expect the industry to change. Financial institutions will need to examine transactions before they are signed, rather than relying primarily on protecting credentials and responding to suspicious activity afterward. An unusually large transfer, an unfamiliar destination address, or unexpected permissions should be evaluated before funds are allowed to move. These checks can already be performed, but they need to become a standard part of how financial infrastructure operates.
The difficulty of recovering stolen assets makes this even more urgent. In the Binance incident, approximately $3 billion was reportedly frozen, but freezing funds doesn't guarantee their recovery. Unlike certain stablecoins, Bitcoin and Ethereum cannot simply be frozen by a central issuer. Once stolen assets begin moving across blockchains, the chances of recovering them become increasingly uncertain.
For the on-chain security industry, this could create a significant new market. Israeli companies have built extensive expertise in detecting sophisticated threats and protecting financial institutions and critical infrastructure. As more financial activity moves onto blockchains, that experience will become increasingly relevant to securing the transactions themselves, rather than only protecting the systems that authorize them.
The implications also extend beyond crypto exchanges. Banks, payment providers, and other financial institutions are exploring blockchain-based infrastructure, where transactions can be executed automatically and assets transferred within seconds. These organizations will face the same problem if attackers manage to compromise systems with legitimate authority.
I expect transaction-level security to become a much bigger priority for financial institutions, particularly as blockchain technology becomes more widely adopted. Protecting private keys and monitoring suspicious activity will remain important, but institutions will increasingly need independent controls capable of stopping dangerous transactions before they are approved.
The Binance hack may be remembered for the billions that were stolen, but its longer-term impact could be the changes it forces across the financial industry. We already have the ability to examine transactions before they happen. After an attack of this scale, financial institutions have a compelling reason to make that protection a standard requirement rather than an optional safeguard.
Ido Ben-Natan is co-founder and CEO of Blockaid.
