The warning signs had been building long before Thursday. North Korean-linked operators had spent years refining theft, social engineering and cyber sabotage, with the TraderTraitor group already blamed for last year’s $1.5 billion ByBit theft. The Binance attack took that playbook to a new scale: investigators said $6.3 billion was taken in as little as 20 minutes, with automation apparently moving and laundering funds faster than human approval could plausibly keep up. “It had to have been done by a computer,” Chainalysis research chief Eric Jardine said.¹

On Thursday, Binance said the attackers initially compromised an engineer’s laptop, along with other breach points. The exchange halted withdrawals and deposits, later restoring deposits, while blockchain partners froze at least $3 billion of the stolen assets. Co-CEO Richard Teng called it “a complex attack,” saying the intruders used a self-destruct mechanism to erase tools and traces.²

The immediate fight is over what the heist says about where customers should keep their money. Cybersecurity professor Tyler Moore urged users not to leave substantial holdings on an exchange, arguing that “there are no built-in protections” when hacks strike. Ryan Kirkley of Global Settlement Network made the same broader case: without insurance, he said, no common solution makes assets “truly safe.”³

Others see a more nuanced lesson. Blockaid chief executive Ido Ben-Natan said Binance’s pledge to make customers whole means users are unlikely to lose money, and that exchanges must learn from the breach rather than be written off. Brett Falk of the University of Pennsylvania also cautioned that US regulation may not have prevented a laptop compromise, though CFTC Chairman Michael Selig argued offshore platforms lack the safeguards required in American markets.³

By Friday, the hack had also become a public-relations brawl. Former Binance chief Changpeng Zhao asked Elon Musk to stop mocking the exchange and “show a little support,” pointing to Binance’s investment-linked SpaceX stake. Yet the central issue remained harder to dismiss: rapid recovery can limit damage, but it does not erase the vulnerability that made a record heist possible.²