The $6.3 billion Binance theft has again exposed the crypto industry’s security weakness

The theft of $6.3 billion from Binance by North Korea’s elite hacking group has renewed scrutiny of a long-standing security problem in the cryptocurrency industry. Experts say hackers may need to compromise only one employee to get in, and weak internal controls can then turn that foothold into a massive theft.

According to Binance’s initial statement, the October 29 heist, which experts describe as the largest crypto theft ever, took place within minutes after months of planning and preparation.

Cybersecurity specialists say the issue is not only how exchanges protect employees from sophisticated social engineering. A more important question is whether enough internal controls exist to limit what an attacker can do once an employee’s computer or credentials are compromised.

Jonathan Alexander, chief technology officer at OpenZeppelin (part of S&P Global), a blockchain security company, noted that social engineering is a well-understood threat in the industry. In his view, the bigger question is why exchanges lack stronger internal safeguards and circuit breakers to stop an attacker who gains access to an engineer’s computer, as happened at Binance, from escalating access and moving assets.

According to Alexander, inconsistent security practices across the industry deepen the problem. Some crypto advocates have long resisted controls they see as contrary to blockchain’s decentralized ethos. Limits on transaction amounts and automated review of spending patterns are sometimes viewed as violations of privacy rights.

“I think it has led some people to believe that things like circuit breakers and more oversight over accounts would be unacceptable or would run completely against the need to avoid censorship. I think security controls are possible, and protection against this can be provided,” Alexander said.

According to Chainalysis, the Binance attack is the latest in a series of major crypto hacks that have resulted in more than $22.3 billion in stolen funds since 2021. The scale of the losses has intensified debate over whether exchanges need more consistent standards governing access, transaction controls and other defenses.

Alexander said he expects, and hopes for, more clarity and standardization in cybersecurity requirements for the protection and trust of investors. “These incidents show why this needs to change,” he added.

Attractive and highly visible targets

Crypto exchanges are unusually attractive targets because hackers can identify wallets holding large amounts of easily transferable digital assets and, in some cases, the employees with access to the systems that manage them. This has made engineers and IT staff prime targets for sophisticated social engineering operations.

Alex Pruden, CEO of Project Eleven, a blockchain and digital asset security company, said defenders face a fundamental disadvantage: attackers only need to succeed once.

“It’s an extremely hard problem,” Pruden said. “The best practices we’ve built in cybersecurity up to this point simply don’t match the threats of the world we live in.” He added that cybersecurity professionals in the industry “live in a world of constant war. We are under attack all the time.”

Pruden hopes the Binance theft will drive more investment in cybersecurity, including safeguards around internal artificial intelligence tools and agents, which can expand an attacker’s capabilities if compromised.

“We are at the beginning of this story, but I think, as the Binance hack shows, these tools can be turned against you very, very quickly, and the damage can be very hard to undo,” he said.

According to a Reuters report on October 30, crypto exchanges have already moved to strengthen their defenses and increase information sharing following the Binance heist.

Uneven defenses, fragmented oversight

The uneven security practices identified by experts are mirrored in the fragmented U.S. regulatory system. Unlike banks, U.S. crypto exchanges do not operate under a single federal cybersecurity regime. Requirements vary depending on where companies operate and which state licenses they hold.

New York imposes some of the industry’s strictest requirements: the state’s Department of Financial Services requires licensed firms to maintain a cybersecurity program, use multi-factor authentication and appoint a chief information security officer.

Elsewhere, crypto firms may be subject mainly to state money transmitter rules. These regimes generally require companies to report on their cybersecurity programs to regulators and undergo examinations, but often do not specify particular technical controls such as encryption standards.

Many exchanges do not operate in the U.S. and are not subject to state oversight regimes, although they may face separate requirements where they do operate.

Banks, by contrast, are subject to federal requirements covering risk assessments, monitoring and incident response, and the largest institutions are continuously examined by dedicated supervisors.