On October 29, the world’s largest crypto exchange, Binance, reported a security hack. Roughly $6.3 billion was drained from the exchange platform, more than four times the previous record. In February 2025, Bybit reported a heist of $1.5 billion. The incident once again brings into focus cyberattacks led by nation-state actors, as well as the rising incidence of such attacks due to the use of AI. In India, the Binance incident perhaps brought back memories of the WazirX security incident. In July 2024, the platform suffered a major cyberattack and lost about $235 million from a multi-signature wallet managed by Liminal Custody. While cyberattacks on crypto exchanges have increased in recent times, the Binance hack has had a severe impact. First, it is the largest heist so far. Second, considering that Binance is one of the largest players and a major liquidity provider for futures trading, particularly in India, the incident assumes significance. Third, users will evaluate platforms based on the wherewithal they have to deal with such hacks. The most significant step that Binance took was the way the company accepted accountability and assured users that their investments would not be impacted. This was done immediately, which perhaps is one of the reasons there has been no panic among users. Binance was quick to say in a post on X that it would absorb the financial impact of the stolen funds, not its users. “We have already set aside more than 100% of the funds required to cover the loss. As of October 31, 2026, 98% of the impacted token assets have been replenished and are verifiable on our Proof of Reserves page. We are in the process of purchasing the outstanding, more illiquid assets,” said the company. The company, in its latest comment, said: “We have taken immediate action to contain the incident and strengthen the systems involved. The entry points identified as having been used in the attack have been closed. Systems touched in the attack path have been rebuilt or replaced. We have also implemented tighter device controls, enhanced wallet-service risk controls and expanded AI-based behavioural anomaly detection.” Binance also said that the investigation highlighted that the attack was sophisticated and a multi-stage campaign. It was not a single, isolated breach or a simple phishing incident. The attackers combined a range of techniques, including social engineering through fake recruitment interviews, malicious software downloads, compromised internal AI tooling, endpoint compromise and an advanced transaction-authorisation method. The human factor More importantly, social engineering also played its role. This once again brings into focus the role of humans in such attacks. An investigation by the Federal Bureau of Investigation (FBI) linked the Binance hack to North Korea’s TraderTraitor. When asked why nation-state actors have been successful in hacking systems even when they have strong key management systems, Jayant Dave, CISO, APAC, Check Point Software Technologies, who has tracked at least seven major crypto thefts since 2024, said that none had broken the cryptography. His findings were that five began with a staff member’s or supplier’s device, token or session. Four involved a supplier. In four cases, people approved the malicious transaction. “State-linked groups are patient and well-funded, and they go where the defence is thinnest. Strong key management makes the vault hard to crack. So they target what is allowed to ask the vault to open: an engineer’s laptop, a supplier’s tool, an approval screen. The FBI attributes Binance to North Korea’s TraderTraitor. US and Japanese authorities have warned for years about this group’s lures aimed at engineers,” he shared in an email response to Business Standard. In its post on the modus operandi, Binance said that social engineering was also part of the hack. The attackers used a fake job interview, an internal AI tool and a stolen deployment token to reach the internal wallet signing service and start transactions outside the normal withdrawal process. Saurabh Sharma, Lead Security Researcher at the Global Research and Analysis Team (GReAT) at Kaspersky, agrees with the assessment of nation-state actors’ operations. He said that in such cases, attackers rarely break the keys. “They target the people and systems that are already trusted to use those keys. That is why these groups focus on engineers, developers and executives,” he said. In 2025, Kaspersky researchers detailed how BlueNoroff, a Lazarus subgroup, used fake video calls and fake recruiters to compromise people working in the crypto industry. Even experienced specialists can be caught out, as in the case of a blockchain developer who lost $500,000 after installing a fake code editor extension. “Once inside a trusted device, attackers can work through the organisation’s own approval processes. Technology alone cannot stop that if one compromised system is allowed to carry too much authority,” he added. State-linked groups are known for this kind of patience. Kaspersky’s analysis of Lazarus’s Operation FlashHole found a campaign that had been active since at least July 2025, with tools reworked over time to make it more persistent. “For investigators, it also means the first compromised device is rarely the full story. Every access point has to be traced and closed before systems can be trusted again. Exact timelines, however, can only be confirmed once the investigation is complete,” said Sharma. Lessons for Indian players From a security perspective, experts say Indian exchanges are already a target. Sharma shared that the GhostCall and GhostHire campaigns uncovered by Kaspersky have targeted Web3 and cryptocurrency organisations in India since at least April 2025. “The priority should be to make sure no single compromise can move funds. Developer and DevOps machines should be kept separate from systems that approve withdrawals, with independent checks for high-value transfers. This matters because valid accounts and trusted relationships remain leading entry points in the attacks our teams investigate,” he said. Dave says that this is not just an India-specific issue; every market faces this challenge. “Rules and audits confirm the right controls exist. The attackers behind these thefts test whether those controls hold under pressure. They are patient, and they work through people, devices and suppliers. That calls for testing alongside compliance,” he added. Dave also feels that India has built one of the more structured frameworks in the region and that it continues to strengthen it. He points to the CERT-In’s 2022 directions, which require incidents to be reported within six hours and logs to be kept for 180 days. “Crypto service providers must keep KYC and transaction records for five years. FIU-IND registration brings exchanges into the anti-money-laundering framework. Its 2026 guidelines add a cyber security audit by a CERT-In-empanelled auditor. Fast reporting and good logs are exactly what investigators need after an incident like this,” he shared. Though security experts have laid out what needs to be done, it is ultimately up to the players to take security seriously. “At CoinSwitch, we follow a risk-based approach to managing wallet exposure and withdrawals, with a focus on minimising potential vulnerabilities. This includes limiting exposure to online wallets, implementing layered access controls, transaction monitoring and withdrawal safeguards,” said Balaji Srihari, VP, Business, India, CoinSwitch. “We also emphasise segregation of duties and restricted access to critical systems to reduce insider-related risks. These controls are periodically reviewed and tested through security assessments and audits, helping us strengthen our preparedness against evolving external threats as well as potential internal risks,” he added. Nischal Shetty, founder of WazirX, said that security cannot be treated as a one-time exercise or a box to be ticked. It needs to be an ongoing priority, embedded into the way businesses operate. “Cybersecurity is not a crypto-specific challenge; it is a financial ecosystem-wide concern. Traditional banking, fintech and cryptocurrency are all exposed to an increasingly sophisticated threat landscape. However, the scrutiny on the crypto industry is understandably higher, given the direct involvement of funds and the greater difficulty of recovering stolen assets compared to traditional banking. This makes security an especially critical responsibility for the industry,” he added. Shetty also said that with the rapid advancement of AI, the industry is seeing an expanding vulnerability landscape, with new risks emerging across the software libraries, operating systems, browsers and server infrastructure that underpin modern products. “This makes it increasingly important for companies to look beyond preventive security measures and have a plan in place for worst-case scenarios,” he added.
