The first Binance hot wallet started emptying at about 7.05am AEDT on Friday 30 October. Most brokers were still commuting. By the time the exchange had shut off withdrawals, the bulk of what is now the largest theft on record had already gone.
Binance puts the damage at around US$6.3bn (about A$8.9bn). Blockchain analytics firm Elliptic, which has been tracing the funds since the first outflow, puts it slightly higher, at US$6.43bn taken from hot wallets across 11 blockchains. That is more than four times the US$1.46bn stolen from Bybit in February 2025, which held the record until last week.
Over the weekend the FBI formally blamed TraderTraitor, the North Korean state-backed unit it also held responsible for Bybit, describing the raid as “malicious cyber activity” by the group. The attribution came within about 48 hours. As we noted in in our first report on the Binance breach and the worldwide withdrawal freeze, Binance has said customers will not wear the loss. The harder questions now are how it happened so fast, and what that means for everyone else’s cyber cover.
The on-chain record shows an attacker in no rush at all beforehand. Over 28 and 29 October, a newly created wallet received three small withdrawals from the Tornado Cash mixer. On the afternoon of the 29th (UTC), the attacker deployed the “sweeper” contract that would do the heavy lifting, after testing it on a different wallet about four hours before turning it on Binance.
When it went, it went in bulk. Two-thirds of the Ethereum losses, US$2.53bn, left in a single transaction.
Binance’s first explanation pointed to a compromised laptop belonging to a DevOps engineer, which gave the attacker a route into an internal service and the ability to submit unauthorised withdrawals. The exchange has since said it found further points of breach. Co-CEO Richard Teng has said the attack was the work of more than one person, and that the attacker’s tools destroyed themselves as they ran, which has made the forensic work harder.
The Ethereum leg is the part security teams will be picking apart. The attacker used EIP-7702, a feature added in Ethereum’s 2025 Pectra upgrade that lets an ordinary wallet delegate its behaviour to a smart contract. A single transaction carried 50 authorisations, all validly signed with the key of one Binance hot wallet, each covering a different transaction number so one would be guaranteed to land. That handed control of the wallet to the attacker’s contract, which emptied it three and a half minutes later. Teng said the delegation “did not pass through our normal approval controls”.
Elliptic’s assessment is that nobody cracked any cryptography. The attacker appears to have got Binance’s own signing systems to approve the transfers, much as the Bybit thieves did by compromising a developer’s machine at a wallet provider. The weak point was a person with privileged access and the infrastructure that person could reach.
Read next: Clients are buying cyber insurance. That does not mean they are covered
Stablecoins saved Binance a lot of money. Around US$3.46bn of the haul was in dollar-pegged tokens, and unlike bitcoin, their issuers can freeze them. Tether locked the attacker’s main Ethereum wallet 37 minutes after the stolen USDT arrived. Circle followed three minutes later. Ripple, Paxos and several smaller issuers joined in, and the governance bodies of two blockchain networks moved assets out of the attacker’s reach.
Elliptic has so far verified US$2.85bn frozen or seized, about 44% of the total. Before the freezes landed, though, the attacker had already swapped roughly US$786m of stablecoins into assets nobody can freeze, accepting losses of 12% to 26% on some trades to get out quickly. Around US$3.2bn now sits in bitcoin, ether, XRP and other native tokens with no issuer to call.
The laundering itself looks largely automated. One Tron wallet made 546 transfers with a median gap of 96 seconds, running through the night in Pyongyang, in randomised amounts designed to slip past simple monitoring rules. Elliptic says it cannot yet tell whether AI agents are involved or just conventional scripts.
Getting the frozen money back is a separate fight. Ari Redbord, global head of policy at TRM Labs, told US media that “a freeze stops the money from moving, and recovery follows through legal process”, which can take months or years.
Read next: Australian cyber insurance is finally consistently profitable so why isn’t the market growing?
Binance is absorbing the loss itself. It says it has set aside more than US$6.34bn of company money. Its Secure Asset Fund for Users is worth roughly US$1bn to US$1.2bn, so the balance sheet is doing most of the work. By Sunday the exchange said it had bought back about US$6bn of the stolen tokens. Withdrawals, which it had hoped to reopen that day, stayed shut.
Very few companies on earth could do that. Insurance Business UK has reported has reported that publicly disclosed limits in the specialist crypto theft market are a small fraction of a loss this size. A mid-tier exchange, or a fintech holding client funds in hot wallets, would be relying on a policy, and that is where the detail of the wording starts to matter.
Few Australian businesses could absorb a theft the way Binance has, so the useful question for brokers is what a local cyber policy would do with something similar. Insurance Business put the scenario to two insurers: if attackers break into a company’s own systems and use them to approve a payment out, without impersonating a supplier or a staff member, does the policy pay, and which part of it pays?
Coalition’s Cyber and Technology Policy 3.0, co-underwritten in Australia by Allianz and Mitsui Sumitomo, treats digital currencies as a recoverable funds transfer loss. Coalition said its funds transfer fraud cover is not confined to the classic business email compromise pattern.
“Our FTF coverage trigger is for fraudulent transfer instructions transmitted by electronic means, not only emails/BEC. There is no need for the bank to be impersonated, only that the fraudulent instruction is sent to either the insured or their financial institution,” said a Coalition spokesperson.
On crypto specifically: “At Coalition, we include cryptocurrency under the definition of funds transfer loss (money, security, digital currencies, or tangible property),” said the spokesperson. The policy’s separate digital asset definition follows the conventional meaning – the insured’s electronic data and software – and Coalition said that is not the section a crypto theft would engage.
Funds transfer fraud is also only one part of a response. “While FTF only deals with the theft of funds, the wider cyber insurance policy would respond to an initial security breach and potential reputational harm loss,” said the spokesperson. She said cybercrime cover would be in scope, and that a business in this position would also need to consider what might be available under cyber liability and professional indemnity.
For brokers, that shifts the conversation from whether a trigger is met to how much sits behind it. The wording sets a separate limit for each insuring agreement, and Coalition told the federal government last year that most Australian SMB policies carry limits of A$100,000 to A$1m.
Structure varies between insurers. In some mainstream cyber wordings the core policy excludes trading losses and the value of electronic fund transfers lost in transit, with theft of funds sitting in an optional module sold separately and carrying its own sublimit. AIG confirmed that this description of the structure is accurate but said the wording on which it was based is out of date and has been retired. The insurer declined to describe its current policy language, which it said is confidential between AIG and its clients.
Coalition said its approach to war follows LMA5567B, a Lloyd’s Market Association endorsement used as a standard across the London market, and that most cyber insurers in Australia take the same approach. Broadly, that structure removes cover for state-backed cyber operations that significantly impair the functioning or security of a state, while restoring it for an insured whose systems sit outside the worst-affected country.
For a custodian or exchange client, the speed of the FBI’s attribution – about two days – makes that drafting worth reading closely now.
None of this means a claim would fail, or that it would be paid. Wordings are negotiated, endorsed and sublimited differently for every client. It does mean that a digital asset or fintech client’s broker should be able to say, before renewal, which section would respond to an unauthorised transfer from a hot wallet, and how much it would pay.
The response window has shrunk to almost nothing. Breach response panels are built to contain an incident over hours and days. This loss crystallised in about half an hour. For clients with any digital value transfer, the cover’s worth is increasingly in the controls underwriters insist on before binding: privileged access management, locked-down engineer laptops, independent approval for outbound transactions and limits on what sits in hot wallets. None of that is exotic. Underwriters on our recent panel on AI-driven cyber risk said they still see clients without MFA and without patching discipline.
Attribution is getting quicker, and that sharpens the exclusion question. Elliptic notes the FBI took five days to name North Korea after Bybit. This time it took two. Lloyd’s Market Bulletin Y5381, standalone cyber policies written at Lloyd’s since 31 March 2023 must exclude state-backed attacks that significantly impair a state’s ability to function or its security. A theft from a private exchange arguably falls short of that bar, and wordings vary. Brokers placing standalone cyber for fintech, payments or digital asset clients through Lloyd’s should know how their wording handles state attribution before a client is in the middle of a claim.
Crypto is often outside the cyber wording entirely. Many mainstream cyber policies either exclude digital assets or route stolen funds to a crime or social engineering section with modest sublimits. Clients that keep operating cash on an exchange, or rely on a decentralised lending protocol, also carry contingent exposure. Lending platform Aave froze some of its markets as a precaution during the Binance incident, a reminder that firms nowhere near the breach can still lose access to their money.
Read next: Australia’s cyber insurance patch exclusions face a real-world test
Five questions for digital asset and fintech clients at renewal
Australia’s Digital Assets Framework, which passed Parliament on 1 April, brings crypto exchanges and custody providers into the AFSL regime. Operators have an 18-month window from Royal Assent to apply. Licensed operators and their directors will face exactly the scrutiny of governance and controls that the Binance breach has put under the spotlight, and ASIC has shown it is prepared to act. In March it secured a A$10m penalty against Binance Australia Derivatives over client onboarding failures. That should mean more demand for D&O, crime and cyber from a sector that has historically been hard to place.
APRA data shows the class wrote just A$32m in gross premium in the March quarter, across about 6,000 risks, and uptake among Australians has been falling
The Binance breach did not need a zero-day exploit or a broken algorithm. It needed one compromised engineer, a well-rehearsed plan and 30 minutes. That combination works against any business that moves money electronically, and underwriters’ proposal forms will soon reflect it.
