Binance said on Thursday that $6.3bn (£4.7bn) of digital assets have been affected by what has been described as the "largest hack in history". For the world's biggest crypto exchange, that is a staggering figure, and it should force a hard look at how these platforms protect the money people trust them with.
The company's own account is worrying in its simplicity. Early checks suggest the incident may have started with an engineer's laptop that had been compromised, which allowed an attacker to make unauthorised withdrawals. A single compromised device should not be enough to put billions at risk. Binance says about half of the affected assets have been frozen with the help of other platforms, and that it will "cover all losses". That promise matters, but customers deserve more than a pledge made after the fact. They need clear evidence of how access to withdrawal systems is controlled and monitored.
Two analytics firms, TRM Labs and Chainalysis, have linked the attack to a North Korean hacking unit called TraderTraitor. TRM Labs' global head of policy, Ari Redbord, called it a "watershed moment" and said the attacker still holds an enormous sum, so recovery efforts are far from over. Binance has not directly answered questions about those links, saying only that it is working with law enforcement to identify the criminals. Until that work is complete, the public should be cautious about accepting any single explanation.
The response from other firms also deserves attention. Tether said it had frozen around $1.6bn, and Circle said it had frozen more than $800m, while World Liberty Financial said it had helped freeze stolen funds. Those actions show that the industry can act quickly when it coordinates. They also show how much depends on a few large issuers being willing to act. Regulators and exchanges should ask why recovery relied so heavily on voluntary cooperation.
Binance has more than 300 million registered users and said in 2024 that it held over $160bn in assets under custody. A platform of that scale cannot treat security as an internal engineering matter. It should publish a full post-incident report, explain how withdrawals will be re-enabled, and submit to independent review. Co-chief executive Yi He said withdrawals are disabled until the environment is confirmed secure. That caution is right, but it must be backed by transparency.