Binance Survives Record $6.3 Billion Hack as 'Black October' Begins

By Grace Kim

North Korean hackers stole $6.3 billion from Binance last Thursday in the biggest hack in crypto history—and the exchange's customers still got every dollar back. More than 72 hours after the breach, Binance has restored withdrawals on Bitcoin and other major currencies, absorbed roughly $3.8 billion in net losses, and avoided imposing any haircut on its users.

That's the good news. The bad news, according to cyber experts, is that the Binance incident is one piece of a scary new wave of hacking they're calling Black October—and it may be a preview of attacks against the broader internet.

What exactly happened at Binance?

A simplified version: North Korean operatives got into a laptop belonging to a Binance engineer and installed so-called sweeping tools that moved crypto from the company's wallets to ones the hackers controlled. The operation was sophisticated enough to lock out Binance's security team and rip up the log records that could have shown how the intruders broke in.

Binance co-CEO Yi He—who is seven months pregnant—and other executives reacted fast. They unplugged part of the exchange and halted all withdrawals, but not before the North Koreans made off with $6.3 billion.

The Binance team caught a break when longtime rivals Tether, Circle, and Coinbase froze around $2.5 billion of the stolen USDT and USDC stablecoins within hours. The rest—Bitcoin, Ethereum, Solana, and various off-brand currencies—is gone for good, and will likely buy more weapons for the DPRK.

The attack played out Thursday afternoon and evening, New York time. By Saturday, withdrawals were live again. In short: the company caught the theft fast, but not fast enough.

How is Binance covering $3.8 billion in losses?

Binance has reassured customers their funds are safe and says it can offset the roughly $3.8 billion in net losses. It's doing this in part by raiding reserve funds originally set up to stabilize volatility at its derivatives business. The company will presumably scratch together the rest from operating income and, possibly, one or two short-term loans.

Binance also ran what amounts to a masterclass in crisis management: regular, candid updates that reassured customers and markets the situation was contained. But the crisis response doesn't answer the harder question—how hackers pulled off a robbery of this magnitude at all.

It's easy to accuse Binance of weak safety protocols. By all accounts, though, the North Koreans displayed extraordinary skill and knowledge to circumvent the company's layers of permissions. Binance has launched joint investigations into the hack with the Secret Service and the FBI.

Where does AI fit into the attack?

There's no evidence AI agents directly carried out the attack. But the speed of its execution—and the subsequent steps to drain the funds to thousands of wallets—suggests the North Koreans are using AI to hone their tradecraft, much as office workers use tools like Claude to be more productive.

That's the frightening part. AI is helping hackers improve at every stage of their crimes:

• Making deepfakes of employees to penetrate a company's system
• Writing hyper-polished code capable of stealing as much as possible
• Training LLMs that specialize in cybercrime, using data gathered from hacks like the one on Binance, according to reports on criminal syndicates

Put plainly: the same tools boosting legitimate productivity are sharpening the attacks.

Is this only a crypto problem?

Some news reports framed the Binance hack as a 2020-style crypto bro escapade. The broader threat is much greater. The North Koreans and others will almost certainly apply the techniques honed at Binance against traditional Fortune 500 companies.

And unlike certain industries, crypto companies are typically excellent at security, employing serious people with deep backgrounds in military intelligence and computer science. If the North Koreans can rob Binance, it's a safe bet they can find targets among banks, credit unions, government agencies, and nearly anyone who is online.

The web, in short, is about to become a lot more dangerous.