Binance Saw the Largest Crypto Heist Ever. Experts Explain How Security Flaws Enabled It.

Binance's estimated $6.3 billion hack is drawing scrutiny beyond the cryptocurrency industry, with security experts warning that trusted devices and legitimate credentials can give criminals a route into systems without stealing the cryptographic keys that protect digital assets.

The exchange initially said a compromised DevOps engineer's laptop may have allowed an attacker to access an internal service container and submit unauthorized withdrawals. It reported finding no evidence of a wallet private key leak.

"We don't know the full details of this incident yet, and we may not for some time," Tomas Sinicki, managing director at Coveron, an identity theft and scam protection service developed by Nord Security, told IBT. "But even what is confirmed so far points to a familiar pattern."

Binance subsequently disclosed additional breach points. Co-CEO Richard Teng said the attack involved a more complex process than simply using one engineer's permissions, cautioning against attributing responsibility to an individual.

Frances Zelazny, general manager of new market initiatives at Prove, told IBT that the distinction between a trusted device and a trustworthy action is central to understanding the risks. "Securing a credential is not the same as securing the identity and authority behind an action," she said. "A device is not a person. An employee's legitimate device can be compromised."

"A credential is not a person either, especially in a world where credentials are not bound to humans and can be used by someone or something else." Binance said approximately $3 billion in affected assets had been frozen and pledged to cover losses through its Secure Asset Fund for Users, known as SAFU, and company resources.

On Friday, CoinDesk reported that the exchange had set aside more than $6.34 billion, separate from frozen assets, to address the losses. However, reimbursement does not resolve the security questions raised by the intrusion. "At the same time, authentication does not equate to authorization," Zelazny said. "A legitimate user or service may have access it should not have."

"And a digital signature does not establish intent. It establishes that the required cryptographic authorization occurred, not that the transaction or the person behind it was legitimate." Her warning addresses the possibility that an attacker could manipulate an authorized system while the underlying cryptographic safeguards continue functioning.

"The lesson from Binance is not that cryptography failed," Zelazny said. "It's that protecting keys may not be enough if the systems authorized to use them can be manipulated." Binance has promised a detailed technical account after investigators verify the facts. The final losses, recovery totals and full intrusion path remain unsettled.

"Much of this story is still uncertain: the final losses, the number of breach points, even who is responsible," Sinicki said. "That uncertainty is a lesson in itself: by the time the facts are settled, the damage is done."

He warned that smaller victims lack comparable recovery resources. "This is something we see at the individual level too, having supported customers through crypto wallet wipeouts that they could not reverse on their own," Sinicki said.

Zelazny questioned how a less financially resilient organization would survive."What happens next time, when the organization on the other side of the attack cannot absorb billions in losses?" she asked. For Sinicki, the priority is prevention: "When identity is the entry point, protection has to come before the breach, not after."