It’s been more than 72 hours since North Koreans robbed Binance in the biggest hack in crypto history and, by all indications, things will be fine. The company’s executives, who went days without sleep to evict the hackers, have gotten the exchange up and running again—all without imposing a haircut on their customers. That’s the good news. The bad news is that the Binance incident is just part of a scary new wave of hacking that cyber experts are calling Black October—and that could be just a preview of a coming wave of attacks against the broader internet.
Before turning to the bigger picture, it’s worth recounting just what happened at Binance. A simplified version goes like this: The vile North Korean regime, which relies on crime to keep Dear Leader in power, got into a laptop belonging to a Binance engineer and installed so-called sweeping tools that moved crypto from the company’s wallets to ones controlled by the hackers. The operation was sophisticated enough that it not only locked out Binance’s security team, but ripped up log records that provided clues to how the hackers broke in.
Binance’s co-CEO Yi He, who is seven months pregnant, and other execs reacted quickly. They unplugged part of the exchange, halting all withdrawals—but not before the North Koreans stole $6.3 billion. This is a staggering amount, but the Binance team caught a break in the form of a lightning response on the part of longtime rivals Tether, Circle, and Coinbase, which froze around $2.5 billion of stolen USDT and USDC stablecoins. But the rest of the stolen funds—consisting of Bitcoin, Ethereum, Solana, and various off-brand currencies—are gone for good, and will soon be buying more weapons for the DPRK.
All of this went down on Thursday afternoon and evening, New York time. By Saturday, as Halloween went into full swing, Binance had turned on withdrawals again for Bitcoin and other major currencies. Meanwhile, the company has reassured customers their funds are safe and that it will be able to offset the roughly $3.8 billion in net losses. Binance is doing this in part by raiding reserve funds set up to stabilize volatility at its derivatives business. The company will presumably scratch together the rest by tapping into its operating income and, possibly, arranging a short-term loan or two. All’s well that ends well—sort of.
Binance put on a masterclass in crisis management with regular and candid updates, helping reassure customers and the markets that the situation was contained. But there’s still the question of how the hackers could pull off a robbery of this magnitude in the first place. It’s easy to accuse Binance of failing to implement adequate safety protocols but, by all accounts, the North Koreans displayed extraordinary skill and knowledge in order to circumvent the company’s layers of permissions. There’s also the question of AI.
There’s no evidence AI agents directly carried out the attack. But the speed at which it was executed, and subsequent steps to drain the funds to thousands of wallets suggest the North Koreans are, at the least, using AI to hone their tradecraft—in the same way that many of us have used tools like Claude to be more productive at our jobs.
This is the frightening bit: AI is helping hackers get better at every stage of their crimes. That includes making deepfakes of employees in order to get into a company’s system, to writing hyper-polished code capable of stealing as much as possible. Even more sinister, there are reports of criminal syndicates gathering data related to hacks like the one on Binance, and using it to train LLMs that specialize in cybercrime.
It may be tempting to think all of this as a problem that will only afflict crypto. Indeed, some news reports painted the Binance hack as a 2020-style crypto bro escapade, but the broader threat is much greater. The North Koreans and others will almost certainly employ the techniques they honed in the Binance hack to go after traditional Fortune 500 companies.
What’s more, unlike certain industries, crypto companies are typically excellent at security—employing serious people with deep backgrounds in military intelligence and computer science. In the case of Binance, the company has already launched joint investigations into the hack with the Secret Service and the FBI. If the North Koreans can rob Binance, it’s a safe bet they can also find targets among banks, credit unions, government agencies, and nearly anyone who is online. The web is going to become a lot more dangerous.
Jeff John Roberts
jeff.roberts@fortune.com
@jeffjohnroberts
This story was originally featured on Fortune.com
