Binance’s refund promise won’t pay your suppliers during a freeze

The headline number is staggering, but the real lesson for business is duller and more useful. Binance can probably absorb the loss. What it could not do was give customers their money when withdrawals stopped. For any company treating a crypto exchange as a bank account, that is the risk that matters, and it is one standard compliance checks barely look at.

Twenty minutes, ten blockchains

According to blockchain intelligence firm TRM Labs, an attacker moved approximately US$6.36 billion out of Binance wallets on ten blockchains, most of it in about 20 minutes. RNZ put the figure at NZ$11.2 billion, potentially the largest financial heist ever recorded. Elliptic says the attack spanned 11 blockchains within roughly three hours, a level of coordination its co-founder Dr Tom Robinson says very few actors could manage.

Three analysis firms converged on the same suspect. TRM attributes the attack to TraderTraitor, North Korea’s elite hacking unit, and says it makes that judgment “with high confidence”. Chainalysis co-founder and CEO Jonathan Levin says the hack was “likely done by DPRK group TraderTraitor”. Robinson adds caveats worth noting: no government has formally attributed the attack yet, and slower than usual laundering has allowed US$2.6 billion to be frozen.

This is a pattern, not an anomaly. In February 2025, the Bybit exchange lost US$1.5 billion in a hack the FBI pinned on the same North Korean group. A sanctioned state now treats centralised exchanges as a revenue line for its nuclear programme.

The safety fund was a sixth of the bill

Binance says it will cover all losses and has set aside around US$6.34 billion of company funds. That is credit to its balance sheet. But note where the money is coming from. Binance’s Secure Asset Fund for Users, created in 2018 for exactly these “extreme situations”, holds US$1 billion in bitcoin. The theft was more than six times that buffer.

The make-good depends on the exchange having deep enough general reserves. Binance does. Plenty of smaller platforms would not. Against the US$162.8 billion it reported holding in custody in its 2025 annual report, the loss equals about 3.9% of customer assets, enough to sink a weaker operator outright.

One signature, unlimited access

The breach appears to have started with a compromised engineer’s laptop that gave the attacker access to internal systems and the ability to make unauthorised withdrawals. Kok Tin Gan, co-founder and CEO of cybersecurity firm NyxLab, is blunt: “This looks like one signature that gave the attacker a never-expiring, full-access token to a Binance hot wallet.”

If that holds up, the world’s largest exchange left a single credential standing between live customer funds and a state-sponsored hacking unit. No multi-party approval, no time limit. That is not a crypto problem. It is an internal controls problem, and any finance director would recognise it.

Compliance checks look the wrong way

Most due diligence on exchanges is borrowed from retail banking: licensing, KYC, anti-money laundering monitoring. Those tools ask whether the platform knows its customers. They do not ask how many engineers can move a hot wallet, or whether a laptop compromise can empty it. The counterparty risk that just materialised sat entirely inside Binance’s own engineering access architecture.

There is no reported New Zealand corporate exposure. But any local fintech, payments provider, exporter or investor holding digital assets on a centralised exchange carries the same profile: concentrated custody, a single point of failure and an adversary that standard frameworks were never built to catch.

Treat it as a treasury problem

The Coop Media’s analysis gets to the point most coverage misses. “For businesses using crypto to settle payments, suspended withdrawals mean losing access to a payment route, even if the exchange promises reimbursement.” Its recommendations are practical: cap operating balances held on any one exchange, keep an independent payment route, verify changed destinations and large transfers through a second channel, and actually test recovery of access and records. Its conclusion is that payment continuity belongs in board-level crypto treasury policy alongside asset protection.

That is the right frame. Hot wallets offer liquidity and carry exposure. Cold storage is safer and slower. Neither replaces a plan for the days your money is out of reach.

Binance will likely reopen withdrawals, repay customers and survive. Investigators will keep chasing the laundered funds, and a formal government attribution may follow. The next TraderTraitor target is already being scoped. Businesses that hold crypto should ask their exchange the questions a KYC form never covers, and size their balances on the assumption that one day they will not get an answer.

Sources

• 1News: North Korea linked to $11b hack on world’s biggest crypto exchange (2026-10-30)
• RNZ: Hackers steal $11.2 billion from Binance in record heist blamed on North Korea (2026-10-31)
• Elliptic: The largest theft in history, sanctioned actors linked to North Korea behind the $6.4 billion Binance hack (2026-10-30)
• Chainalysis: Binance Hack, tracing the $6.4 billion theft to North Korea (2026-10-30)
• NZ Herald: Suspected billion-dollar Binance hack sends fear through crypto (2026-10-30)
• Stuff: Blockchain intelligence firms link North Korea to US$6.3B hack on Binance (2026-10-30)
• The Coop Media: Binance’s $6.3bn breach puts crypto custody to the test (2026-10-30)