Binance hack and the $6.3 billion theft: what investigators are looking at

The attack on Binance put fresh focus on crypto custody risk, not blockchain itself. For PSPs and exchanges, the useful takeaway is simple: the weak point is often the plumbing around the chain, not the chain.

1. The theft was valued at USD 6.300 billion and immediately raised questions about custody systems, access controls, and who was behind it. One of the lines of inquiry is possible involvement by hackers linked to North Korea.
2. Ariel Aginsky, a lawyer specializing in IT and new technologies, told Infobae a la Tarde that the incident does not necessarily mean blockchain technology itself was compromised. His point was that Binance is a bank, not the blockchain itself; the attack would have targeted the systems the exchange uses to connect its internal operations with external networks.
3. In Aginsky’s description, the attackers may have exploited the “mouths” between Binance’s internal machinery and outside blockchain networks. That matters because it shifts the focus from the ledger to the controls around custody, transfer initiation, and network interfaces — the places where operational security usually lives or dies.
4. Aginsky said the scale of the operation points to an organized criminal group, not a lone actor. He also raised the possibility of social engineering, including a fake job offer or professional contact that could have led someone with access to install malicious software. In his words, this kind of operation takes months of planning.
5. During the interview, Aginsky cited analyses by Elliptic and Chainalysis, which reportedly found indicators consistent with activity attributed to Lazarus. He stressed that attribution was not confirmed. The case is being compared with the USD 1.500 billion Bybit theft in February 2025, which U.S. authorities attributed to North Korean hackers identified as TraderTraitor.

The practical point for high-risk payments firms is that the label on the asset class matters less than the security model around it. When a crypto platform loses funds, the investigation usually starts with custody architecture, privileged access, and transaction routing — exactly the parts acquirers and PSPs care about when deciding whether a counterparty can actually hold client funds safely.