On a Thursday afternoon, one transaction moved about $2.4 billion out of wallets Crystal Intelligence attributes to Binance, the world’s largest crypto exchange. Nine more followed within 24
On a Thursday afternoon, one transaction moved about $2.4 billion out of wallets Crystal Intelligence attributes to Binance, the world’s largest crypto exchange.
Nine more followed within 24 seconds.
Binance IPO (2:30)Withdrawals got frozen as the company investigated what it first called a “potential security issue.” By Thursday night, Binance estimated the impact at around $6.3 billion, making it what is believed to be the largest crypto hack on record.
As Binance raced to contain the damage, Cathie Wood's ARK Invest went on CNBC with a different warning.
The investment firm said the risks behind cyberattacks are changing quickly, and defenders may need the same powerful tools hackers increasingly have access to.
Related: Standard Chartered sees new winner after Binance hack
Frank Downing, ARK Invest’s director of research for AI and cloud, said Thursday night that the firm had been watching cybersecurity risks rise alongside advances in AI.
“This is a risk we’ve been watching build over time as AI models have brought this amazing productivity force into the market and into the world but also made hackers more productive as well.”
Downing stressed that ARK’s crypto team was “covering this story very closely.” He also said early indications suggested Binance had enough liquidity to absorb the losses.
That assessment has since gained some support from Binance itself. The exchange said it will cover all losses using its Secure Asset Fund for Users, or SAFU, and company funds. Binance later said it had reserved more than $6.34 billion for that purpose.
Downing did not say AI caused the Binance attack. No evidence has emerged showing that artificial intelligence was a force behind the breach.
Instead, his warning was broader: advanced AI can increase productivity for cybersecurity teams, but it can also make attackers faster and more capable.
Downing argued that restricting frontier AI models is not necessarily the answer. Hackers can already use powerful open-source models, he said, so defenders need access to high-performance AI systems quickly enough to keep pace.
The outflows began on Oct. 29. Binance suspended withdrawals as it investigated the breach and said deposits remained operational.
Its first theory pointed to a compromised laptop belonging to a DevOps engineer. Binance said the attacker may have used that access to reach a service container and submit unauthorized withdrawal transactions.
Later, Binance co-CEO Richard Teng said investigators had discovered additional breach points beyond the employee's laptop. He described the incident as a complex attack and said the hackers used a self-destruct mechanism to erase evidence.
Binance has worked with stablecoin issuers, blockchain firms and other partners to freeze roughly $3 billion of the affected assets. Tether froze more than $1.57 billion in USDT, while Circle blocked more than $800 million in USDC linked to the incident.
Suspected North Korea-linked hacks accounted for nearly 89% of reported crypto hack losses through Oct. 29, 2026, up from 15% in 2021, according to Chainalysis.The exchange is targeting Sunday for withdrawals to resume as it rebuilds and tests parts of its infrastructure.
Blockchain intelligence firms TRM Labs and Chainalysis have both linked the attack to North Korea’s TraderTraitor hacking unit, which has been linked to other major crypto thefts, including the 2025 Bybit hack.
Binance has not publicly attributed the attack to any group.
If you follow our market coverage, don’t miss the Roundtable 100. Updated every Friday, it's a power ranking of the 100 most investable tech stocks, including digital assets. Check out the latest RTB 100 rankings at roundtable100.com.
Related: Wall Street analyst recommends buying opportunity after Binance hack
