Binance’s $6.3 Billion Hack Puts Crypto Insurance Under Scrutiny

A $6.3 billion breach at cryptocurrency exchange Binance is raising questions over whether insurance policies covering digital assets would respond to losses linked to state-sponsored cyberattacks, putting war exclusions and attribution requirements in the spotlight.

The theft, which blockchain analytics firm TRM Labs has linked to North Korean hackers, would dwarf the previous record cryptocurrency theft of about $1.5 billion from Bybit in February 2025. Binance has said it will cover the losses, while investigators and industry partners work to recover the stolen assets.

The incident comes as insurers and brokers expand coverage for cryptocurrency businesses, with specialist capacity concentrated in London’s insurance market, including Lloyd’s of London.

Binance estimated the total impact at $6.3 billion, saying about $3 billion had been frozen with help from industry partners. Approximately $3.3 billion remained outstanding, including about $2.4 billion in bitcoin and ether, according to figures cited by TRM Labs.

The breach could test the boundaries of cyber insurance policies that exclude certain state-backed attacks, although the applicability of those exclusions would depend on the policy wording and evidence establishing the perpetrators’ links to a government.

Under Lloyd’s Market Bulletin Y5381, standalone cyber policies written at Lloyd’s since March 31, 2023, must exclude war and certain state-backed attacks that significantly impair a state’s ability to function or its security capabilities. The rules also require policies to specify a robust basis for attributing an attack to a state.

Whether the theft of assets from a private cryptocurrency exchange meets that threshold could become a point of dispute, particularly if insurers and policyholders disagree over the meaning of a state-backed attack and the evidence needed to establish attribution.

TRM Labs has linked the breach to TraderTraitor, a North Korean hacking group that the U.S. Federal Bureau of Investigation blamed for the Bybit theft. A formal attribution by authorities could influence any subsequent insurance dispute, although it would not automatically determine whether an exclusion applied.

Binance has not disclosed how many customers were affected. It suspended deposits and withdrawals while investigating the breach.

According to Binance’s preliminary investigation, the attacker gained access through a compromised laptop belonging to a DevOps engineer before reaching an internal service and submitting unauthorised withdrawals. The company said it had found no evidence that wallet private keys were leaked, although at least one blockchain security firm has disputed its account.

Binance said it would cover losses through its Secure Asset Fund for Users, known as SAFU, and company funds. Established in 2018, the fund is held entirely in bitcoin and was estimated to be worth between $1 billion and $1.2 billion, depending on market prices. The fund alone would therefore cover less than a fifth of the estimated loss.

The recovery of frozen assets could take time. TRM Labs’ global head of policy, Ari Redbord, told CNBC that returning frozen stablecoins to their owners typically requires legal proceedings, with no standard timetable for resolution.

Tether, the issuer of the world’s largest stablecoin, froze roughly $1.57 billion, while Circle froze more than $800 million, according to figures reported in connection with the incident. Ripple, the Arbitrum Security Council and World Liberty Financial also contributed to efforts to immobilise funds.

Bitcoin and ether cannot be frozen by a central issuer in the same way as centrally administered stablecoins, complicating recovery efforts for the outstanding assets.

The breach also highlighted the potential for losses to spread beyond the directly affected exchange. Decentralised lending protocol Aave froze some markets as a precaution, while Binance.US and Coinbase said their platforms were unaffected.

Bitcoin fell more than 3% to a six-week low following news of the breach, while Binance’s BNB token declined between 5% and 8%.

Tim Sun, a senior researcher at HashKey Group, told Reuters that the incident could prompt investors to reassess counterparty, solvency and liquidity risks at centralised cryptocurrency exchanges.

North Korean-linked groups have become a major source of losses for the cryptocurrency industry. TRM Labs said such groups accounted for about 76% of the value of cryptocurrency hacks during the first four months of 2026. The Binance incident follows a loss of roughly $350 million at Bitget in September.

For insurers, the scale of the Binance breach underscores the challenge of pricing risks that can produce losses far beyond conventional cyber incidents. Specialist cryptocurrency insurance capacity has expanded, but publicly reported limits remain small relative to the estimated Binance loss.

Evertas provides cryptocurrency insurance with backing from Arch, a Lloyd’s syndicate member, while insurance broker WTW bought Redefind, a managing general agent specialising in cryptocurrency theft cover, in June.

The Financial Conduct Authority, Britain’s financial regulator, is also preparing to introduce a new regulatory framework for cryptoassets. The FCA published its final rules on June 30, and the authorisation gateway opened on September 30, with applications due by February 28, 2027. The regime is scheduled to take effect on October 25, 2027.

The framework will require authorisation for firms undertaking regulated cryptoasset activities, including trading, custody and intermediation. Greater regulatory scrutiny could increase pressure on firms to demonstrate adequate controls and financial resilience, while directors may face heightened accountability.

For brokers, the breach is likely to reinforce the need to review policy language covering state-backed attacks, war, social engineering and digital asset custody. Insurers may also scrutinise exchanges’ use of hot wallets, privileged access controls and endpoint security for engineering staff.

Stay ahead of the Stories shaping our world. Subscribe to Impact Newswire and join our 
WhatsApp Channel for updates on global tech, business, and innovation—all in one place.

Dive deeper into the future with the Cause Effect 4.0 Podcast, where we explore the ideas, trends, and technologies driving the global AI conversation.

Got a story to share? Contact Us to reach a global audience with Impact Newswire.