Written by Annabel Lovell, Broadgate’s Payments + Digital Assets Legal, Finance & Compliance Hiring Consultant. Drawing on six years of experience in compliance and financial crime, Annabel examines what the Binance hack means for the industry, its regulators and the people responsible for managing risk.
Twenty minutes, $6.3 billion
At 8:05pm UTC on Thursday 29 October, money started leaving Binance. Most of it was gone within about twenty minutes, across ten blockchains, according to TRM Labs. Binance puts the loss at about $6.3 billion; TRM and Elliptic count slightly more.
That is roughly four times the $1.5 billion taken from Bybit in February 2025, and the largest crypto theft on record. Elliptic’s Tom Robinson went further, calling it “almost certainly the single largest known theft of any kind in history.”
A confession before we start: I have skin in this game twice over. I recruit compliance, financial crime, legal and risk people for crypto and payments firms around the globe. Before that, I spent six years as a compliance and financial crime officer. So when a hack report lands, I skip the drama and go straight to the bit where the controls failed.
This time, it’s uncomfortably close to home. By Binance’s own account, the biggest heist in history started with a job interview. Not one Binance held, but one its own engineer attended, with a company that did not exist. For the record: not my client, not my candidate, and I’ve never set a take-home task that emptied a hot wallet.
It started with an interview
Binance’s own report is specific, and awkward reading for my profession. One engineer, whose profile mentioned his Binance experience, was contacted through a legitimate job-hunting platform, which Fortune identifies as LinkedIn, by someone posing as a “Project Director”.
A first-round interview with an “HR representative” followed, then a second with the “CEO” of a fictitious company, who set an “assignment” to download. The assignment was the way in. If you have ever walked out of an interview convinced it could not have gone worse, take comfort: yours did not cost your employer $6.3 billion.
Separately, a second engineer installed a tampered copy of the developer tool Homebrew from an online ad. Binance caught it, but not before the attackers learned who managed the company’s wallets.
On 20 October, nine days before the theft, a compromised machine was “used as a springboard.” The attackers compromised an internal AI tool and took control of wallets belonging to two other engineers. From there, according to Fox Business, they used that tool to submit withdrawal requests Binance’s systems treated as genuine.
The execution was patient and precise. TRM says preparation began at least 36 hours earlier, funded by small withdrawals from Tornado Cash. On Ethereum, the attacker abused EIP-7702, a feature that lets a wallet hand its behaviour to a smart contract, firing 50 pre-signed authorisations in a single transaction in the hope one would match. One did. Binance says it found no evidence its private keys were compromised. TRM’s view is that the attacker probably controlled the hot-wallet signing system itself, which is how valid signatures appeared on ten chains within hours.
On 31 October the FBI attributed the theft to TraderTraitor, the North Korean unit it also blamed for Bybit. TRM estimates North Korea has stolen $7.4 billion in crypto in 2026 alone, and $12.8 billion since 2017. At that scale it is less a hacking operation than a treasury function.
Who pays: not the customers, this time
Binance’s first answer was the right one: users would not bear the loss. Withdrawals began reopening over the weekend of 31 October and 1 November, starting with ETH, USDT and USDC. By 2 November Binance said it had replenished about 95% of affected assets from its own funds, and it published a zero-knowledge proof of reserves covering ten tokens.
Look at how that was paid for. SAFU, the emergency fund Binance set up in 2018, holds roughly $1 billion to $1.2 billion, less than a fifth of the loss. The rest came from its futures insurance fund, its bitcoin reserve and its corporate treasury. Very few firms on earth could write that cheque. Some will conclude Binance is too big to fail. Regulators are more likely to conclude it is too big to be this easy to rob.
Customers took the reassurance and some of their money anyway. Trading firm QCP put net outflows at about $3.6 billion once withdrawals reopened, and DeFiLlama data showed 24-hour net outflows peaking near $7 billion. Bitcoin fell about 5% to below $80,000, and US bitcoin ETFs had their biggest one-day outflow of the month. Not a bank run, but you could see the queue from the street.
The regulators’ turn
Binance does not come to this with a clean slate. In 2023 it paid $4.3 billion to settle money laundering and sanctions charges, under a plea deal that put monitors inside the firm reporting to the DOJ and FinCEN. Changpeng Zhao served four months and was pardoned in October 2025. Since March, Senate Democrats have pressed the DOJ over reported Iran-linked flows, and in April Senator Blumenthal asked what had become of the monitors. Binance says its compliance programme is rigorous. A record theft is not the backdrop you would choose for those conversations.
United States. Washington’s reaction says more about Washington than about Binance. President Trump offered the analysis: “But it’s a hack.” CFTC Chair Michael Selig said “the real issue here is that these are unregulated offshore exchanges” and pitched a voluntary “federal option” for them to register. Binance, which won full authorisation in Abu Dhabi in December 2025, may quibble with “unregulated”. Senator Cynthia Lummis argued the stalled CLARITY Act would have given firms legal cover to freeze suspicious transfers; Better Markets disputes that reading. Expect the hack to be quoted in every speech about reviving CLARITY, by both sides.
South Korea. Seoul moved fastest. The Financial Services Commission held an emergency meeting with exchanges on 2 November, checking cold-wallet ratios, signing procedures and administrator privileges. The law already requires 80% of customer assets to be held offline, and a higher minimum is the fix most discussed. One official estimated that round-the-clock cold-wallet operations need at least 15 staff, or about 20 for three shifts. Another said regulators’ security data requests are up “more than tenfold”.
European Union. Binance has no MiCA licence. It missed out this summer, its French, Spanish and Polish registrations lapsed, and ESMA and regulators in France, Germany and Greece have been questioning its reliance on reverse solicitation, an exemption ESMA says should be “very narrowly framed”. The hack will not make its push for a licence any easier.
United Kingdom. Binance has said it plans to apply under the FCA’s new regime, whose application window opened on 30 September. In a 2021 supervisory notice, the FCA said Binance was “not capable of being effectively supervised”. Any application will now be read with the incident report open beside it, and somebody senior will have to sign their name under the words “this won’t happen again.”
The theft was fast. The clean-up won’t be.
The theft is over. The financial crime problem has barely started, and most of it will not sit at Binance.
About $2.7 billion to $3 billion in stablecoins was frozen within hours. Tether froze about 1.77 billion USDT and Circle about 825 million USDC, with Ripple, World Liberty Financial and Arbitrum’s Security Council adding smaller amounts.
TRM estimates the attacker still holds about $2.4 billion in ETH and BTC, which no issuer can freeze. Chainalysis says some funds have already commingled with proceeds of the $351.6 million Bitget theft in September. North Korea’s usual exit runs through bridges, swap services, OTC desks and Chinese brokers.
That turns a Binance problem into everyone’s. The FBI, Secret Service and IRS-CI have asked exchanges and DeFi firms to “block transactions with or derived from” the attackers’ addresses. These are the proceeds of a sanctioned state, and US civil sanctions enforcement is strict liability: a firm that processes these funds, even several hops removed, can face penalties whether or not it knew. In my compliance days, that was the alert that ruined a weekend. Over the next year, it will ruin a lot of them, for screening teams, OTC counterparties, nested-exchange reviews and anyone whose travel rule data is less complete than they would like.
The freezes also opened two arguments lawyers will enjoy. The first is ownership: freezing funds does not return them, and legal experts quoted by Forklog say recovering them may need court decisions in several jurisdictions. The second is fairness. Nearly $3 billion was frozen in hours for Binance, yet Circle was criticised for not moving quickly after April’s roughly $290 million Drift hack. As one critic, Anton Golub of Forte, put it, smaller projects are usually told issuers need a court order. An industry built so nobody could freeze your money met its biggest crisis by freezing money. Gizmodo put it bluntly: crypto responded by acting like banks.
The insurers will have questions too. Lloyd’s cyber wordings must exclude certain state-backed attacks, and a formal FBI attribution to North Korea strengthens an underwriter’s hand. Brokers are being told to expect sharper questions from underwriters on hot-wallet exposure, privileged access and endpoint security, and on whether self-insurance funds actually hold what they claim.
Three reasons this might blow over
It would be easy to overstate all this, so here is the case for calm, and what would settle each point.
First, the market may simply shrug. Binance made customers whole quickly, and StoneX analysts praised the speed of the response. Crypto also has a famously short memory. If outflows reverse and Binance’s market share looks unchanged by spring, the trust consequence I am describing was a one-week story.
Second, regulators may talk rather than act. Washington is in a deregulatory mood, CLARITY is stalled, and Selig’s federal option is voluntary. Seoul’s response so far is guidance, not law. If no major jurisdiction has changed a rule because of this hack by the middle of 2027, the regulatory consequence was mostly speeches.
Third, firms may buy software instead of hiring people. Binance’s own plan leans on technology: AI-powered threat detection, a security research fund and initiatives with leading AI companies. If the industry answers with tools rather than headcount, my next section is wishful thinking. I would only note that an internal AI tool was part of how the attackers got in.
Hiring is now a security control
The consequence nobody will put in a press release is that hiring has become a security control.
North Korea’s playbook, which TRM calls “Code to Custody”, runs through fake recruiters, coding tests that deliver malware and remote workers hired under false identities. Researchers at ESET have tracked fake recruiter profiles on LinkedIn and crypto job boards, AI-altered CV photos and face-swapped video interviews.
In October, the DOJ indicted ten China-based defendants accused of placing such workers at more than 70 US companies. When the world’s largest exchange can be breached because one of its engineers took a call about another job, the hiring market itself becomes an attack surface. Binance says it detected and blocked 57 North Korea-related attempts this year, and that staff in non-public-facing roles may not keep LinkedIn profiles. Candidates should be wary of a take-home test from a recruiter or company they cannot verify.
Hiring managers face the mirror image: the perfect remote engineer whose camera never quite works. I am aware of the irony of a recruiter writing this.
Every scandal I have watched in this industry has ended the same way: with a job spec. Over the next year, I expect firms to look for financial crime investigators and blockchain analytics specialists who can trace exposure to the stolen funds, and sanctions specialists who know DPRK and Iran typologies.
They will need MLROs and compliance heads who can stand in front of a regulator and explain what they learned. Operational resilience, privileged access and insider risk leads will be in demand, as will lawyers for asset recovery across jurisdictions. One Korean official’s estimate of 15 to 20 staff just to run cold wallets around the clock gives a sense of the scale.
These hires will never trend on LinkedIn. They are the quiet aftermath of a loud failure, and they tend to outlive the headlines by years.
Binance can afford to lose $6.3 billion. The rest of the industry cannot afford to learn nothing from it. Lesson one, for anyone with a LinkedIn profile: be careful who interviews you, and check the recruiter exists before you open their homework.
Which brings me, with full awareness of the irony, to a recruiter’s sales pitch. Trust in recruitment has to be earned, and it is hard to foster through a camera that keeps mysteriously freezing.
At Broadgate Search, we are always keen to meet our clients and candidates in person: a real office, a real coffee and a real handshake, no AI necessary. If you are building out compliance, financial crime, legal or risk teams, or wondering where your own next move is, get in touch. Feel free to run due diligence on me first. After this week, it’s a habit worth building. Send me a message.