Changpeng Zhao said Binance contained a cyberattack linked to $6.3 billion in losses and covered the full amount, while the FBI attributed the operation to TraderTraitor, a hacking group tied to North Korea. Zhao said customer assets were not harmed and that on-chain flows returned to net inflows within 24 hours, despite an initial wave of withdrawals.
The incident places one of the industry's largest platforms at the center of a security threat that Zhao described as increasingly tied to state-backed actors, artificial intelligence-assisted attacks, and the expanding use of crypto infrastructure for stablecoins and tokenized real-world assets.
Zhao said he learned of the breach around midnight while in the United Arab Emirates. Although he was no longer handling Binance's day-to-day operations, he said he used his social media accounts to issue updates while the company's operational and security teams worked to contain the attack.
His account described two responses running simultaneously: technical measures to stop the breach and limit further losses, and public communication intended to reduce uncertainty among users. That division reflects a practical problem for large trading platforms during a hack: a delay in explaining an incident can fuel withdrawals even when a platform's systems and reserves remain intact.
FBI links attack to North Korea-connected group
The FBI attributed the attack to TraderTraitor, which U.S. authorities have previously associated with North Korean cyber activity. Zhao linked the episode to a broader pattern in which state-linked groups target cryptocurrency businesses because platforms, wallets, bridges, and service providers can hold substantial digital assets and operate across borders.
North Korean hacking groups have also been accused of targeting traditional financial institutions. Crypto platforms can present a different operational challenge because stolen assets may be moved rapidly through multiple wallets, converted between tokens, or routed across several blockchains.
Zhao said the reported $6.3 billion figure represented the largest known amount tied to a crypto hack. The scale, if sustained by the final accounting, would sharply exceed many previous exchange breaches and would intensify scrutiny of how major platforms separate customer assets, manage wallet permissions, and coordinate with other firms once illicit transfers are identified.
Donald Trump referred to the incident in a comment on Oct. 31, saying he would raise the issue with North Korea if the attribution were confirmed. Zhao said he had not communicated directly with Trump or officials in Washington about the attack.
Withdrawals moved largely into self-custody
Zhao characterized withdrawals after the incident as a normal response by users seeking direct control of their funds. He said fewer than 10% of withdrawn assets were sent to other centralized exchanges, while most moved to self-custody wallets.
That pattern suggests many users were not immediately rotating funds to rival platforms or exiting crypto markets altogether. They were moving assets into wallets where they control the private keys, reducing their exposure to an exchange's operational and counterparty risks.
Self-custody also transfers responsibility to the user. Losing a seed phrase, sending assets to the wrong network, or failing to secure a device can leave funds inaccessible. Zhao said some users later returned assets to Binance after confronting those practical demands, alongside the company's stated containment and reimbursement measures.
He said blockchain data showed net inflows resumed within a day. Such a reversal can indicate that users accepted the platform's explanation and response, although inflow data alone does not settle questions about the long-term operational impact of a breach or the security changes made afterward.
Zhao calls for coordinated defenses
Zhao argued that individual platforms cannot rely only on their own security systems when attackers can move assets between exchanges, wallets, and chains in minutes. He called for cross-platform intelligence sharing, code cross-audits, and a millisecond-level process that could freeze funds across platforms after a confirmed theft.
A coordinated freeze mechanism would face difficult questions about governance, evidence standards, and the risk of freezing legitimate assets. Yet the proposal addresses a recurring weakness in the sector: a platform may identify suspicious transfers quickly but lack the ability to stop them once funds leave its own systems.
Zhao also said artificial intelligence is increasing both the speed and volume of attacks. He cited a day on which four crypto platforms were attacked, arguing that security teams will need greater use of AI-based detection and response tools to keep pace with automated threats.
AI can help attackers create more convincing phishing messages, scan code for vulnerabilities, and automate social-engineering attempts. Security teams use similar tools to identify abnormal wallet behavior, detect suspicious login patterns, and flag large or unusual transfers before they are completed.
Custody practices face renewed scrutiny
The episode is likely to reinforce the distinction between assets held for active trading and assets held for longer-term storage. Traders who need immediate access to markets may accept the convenience of keeping part of their balances on an exchange, while larger or less frequently used holdings can be kept in self-custody if users understand the operational responsibilities involved.
Hardware wallets and offline backups can reduce exposure to an online platform breach, but they do not remove risk. Users need to secure recovery phrases, test transfers carefully, verify receiving addresses, and plan for loss or incapacity. Centralized platforms, meanwhile, need to show that their custody controls, internal approvals, and incident-response procedures can withstand increasingly sophisticated attacks.
Zhao's call for shared defenses points toward a more interconnected security model for crypto platforms. The test will be whether firms can establish fast, credible channels for identifying and restricting stolen funds without turning emergency controls into a source of new operational or user-protection risks.
Worried about exchange hacks? Learn how platforms safeguard funds in this detailed guide to crypto hack recovery.
Disclaimer: The content on this page is provided for general informational purposes only and does not represent the views or financial advice of Toobit. We make no guarantees regarding the accuracy or completeness of this information and shall not be held liable for any errors, omissions, or outcomes resulting from its use. Investing in digital assets involves risk; users should independently evaluate their financial situation and the risks involved. For further details, please consult our Terms of Service and Risk Disclosure.
