Binance is back online after a record crypto theft. The questions are far from settled
The exchange is resuming withdrawals after covering over 90% of the stolen assets. Investigators are still examining how hackers gained access and where the remaining funds went.
Users of cryptocurrency exchange Binance received some welcome news today: just two days after a major heist in which cryptocurrency worth $6.3 billion was stolen, the exchange is resuming withdrawals. The move follows the company’s decision to cover 90% of the stolen amount by purchasing replacement assets with its own funds. The remaining portion consists of less liquid assets that will take longer to recover.
Meanwhile, the FBI has identified North Korea as responsible for the attack. The isolated country has developed a range of schemes to generate revenue, including sending citizens to work remotely for Western technology companies under false identities. The Binance breach is among the largest and most consequential operations attributed to North Korean hackers. Yet many questions remain about how the attack was carried out and how the attackers managed to penetrate the exchange. Here is what is known so far.
The rising value of digital currencies has made cryptocurrency exchanges and platforms increasingly attractive targets for cybercriminals. According to data from cybersecurity firm CertiK, $1.2 billion was lost in 255 attacks on cryptocurrency platforms between July and September this year, compared with $822 million across 222 attacks between April and June. Both figures pale in comparison with the Binance heist, which was significantly larger than the second-largest cryptocurrency exchange theft on record: the $1.5 billion stolen from Bybit in February 2025.
How was the attack carried out?
Attacks of this kind often rely on social engineering, in which hackers use deception to persuade people with administrative privileges to disclose login credentials or grant access to sensitive systems. Another common method is to exploit credentials leaked in an attack on an unrelated platform, particularly when users reuse the same usernames and passwords across multiple services.
Binance initially said the breach involved a compromise of a software developer’s computer, while cautioning that there could be “additional points of entry.” More broadly, hackers target vulnerabilities in the technology underpinning cryptocurrency platforms. These include flaws in the software that operates the systems, as well as weaknesses in the protocols connecting different blockchains.
One potential route involves stealing cryptographic keys, which are used to authorize transfers of funds. Access to these keys can allow attackers to move assets between wallets. Another vulnerability involves so-called hot wallets: cryptocurrency wallets connected to the internet to facilitate transactions. These are generally more exposed to cyberattacks than cold wallets, in which the keys controlling funds are stored offline.
Cold wallets are considered more secure, but they are not immune to attack. Hackers can exploit weaknesses in the hardware or software used to manage them. In July, attackers reportedly stole $100 million in cryptocurrency by exploiting a hardware vulnerability in cold wallets manufactured by Canadian company Coinkite.
According to Bloomberg, the Binance attack can be considered relatively “straightforward” in the context of cryptocurrency theft, because Binance is a centralized exchange. Such platforms act as intermediaries for transactions, unlike decentralized platforms, where users transact directly with one another. In Binance’s case, the attackers may have gained initial access through the credentials of an authorized user before exploiting vulnerabilities in the platform to drain funds.
How is AI changing the threat?
Artificial intelligence is playing an increasingly significant role in cyberattacks. Advanced AI models can help attackers identify software weaknesses, develop attack strategies and execute malicious operations. This can lower the barriers to entry for cybercriminals, while forcing platforms to adopt more sophisticated and frequently updated security measures.
AI can also make social engineering attacks more effective. Attackers can use the technology to profile potential targets, identify individuals with access to sensitive systems and draft convincing messages designed to trick them into disclosing credentials or granting access. While these capabilities affect the broader cybersecurity landscape, the incentives in the cryptocurrency sector are particularly strong because a successful attack can translate directly into substantial financial gains.
Can the stolen funds be recovered?
Another key question is whether the stolen assets can be traced and, ultimately, recovered. Despite the common perception that cryptocurrencies are completely anonymous, transactions are often relatively easy to track. Blockchains are public ledgers, meaning that recorded transactions can be monitored by investigators. This makes it possible to follow the movement of assets between wallets and, in some cases, across different blockchains.
But tracing funds is not the same as recovering them. Cryptocurrencies such as Bitcoin and Ether have no central issuer with the authority to freeze assets. Other digital currencies, particularly dollar-pegged stablecoins such as Tether’s USDT, are issued by centralized companies that can freeze tokens held at specific wallet addresses. This can prevent attackers from moving or converting those assets. Even when funds are frozen, however, returning them to their rightful owners generally requires cooperation between the issuer, the exchange and, where relevant, law enforcement authorities.
In some cases, attackers agree to return stolen assets in exchange for a ransom. The difficulty of converting stolen cryptocurrency into conventional currency, particularly when transactions can be tracked and certain assets frozen, can give hackers an incentive to negotiate. But they are not necessarily under pressure to cash out immediately. They can hold on to the stolen coins in the hope that their value will rise, use them to pay for goods and services, or move them through a complex series of transactions over an extended period before attempting to convert them into conventional currency.
