Binance’s $6.3bn cyber attack will ’sharpen underwriting’ of crypto-exchanges

On 29 October 2026, cryptocurrency giant Binance suffered a cyber incident with an estimated total impact of around $6.3bn (£4.7bn).

Binance announced on social media platform X the following day that it had already reserved over $6.34bn (£4.76bn) of company funds to cover this incident, while $5bn (£3.7bn) of these funds were already held in the exact token assets that were impacted.

The post continued: “Binance has begun recovering affected assets for users and continues to work with law enforcement, issuers, blockchain intelligence firms and industry partners to trace, freeze and recover additional funds.

“The company has already publicly committed to cover losses through company funds.”

Jonathan Choi, director of insurance risk consulting at CyberCube, told Insurance Times that the extent of any insurance claims would depend on “how much of the stolen funds are recovered” and whether Binance has sufficient reserves to absorb the loss that remains.

The largest publicly reported crypto custody insurance programmes are in the hundreds of millions of dollars, he explained, so ”even substantial cover would only meet a small part of a loss this size”.

“The most direct exposure is likely to lie in specialist crime and specie policies covering theft of digital assets, although limits are small relative to this loss,” he continued.

“Cyber policies would typically respond to incident response, forensics and business interruption rather than the stolen assets themselves, as many cyber wordings exclude or sublimit the insured’s own money and digital assets.”

However, with TRM Labs linking the attack to a North Korean state-backed group, he added that the incident may be excluded from a Lloyd’s standalone cyber policy depending on the specific policy wording.

‘Wake-up call’

Binance commented on X that the initial investigation suggested “the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorised withdrawal transactions”.

Jonathan Benton, founder and chief executive at forensic investigations and asset tracing firm iSanctuary, said that the hack serves as a “wake-up call” to recognise the “scale and sophistication of organised crime targeting digital assets”.

When a crypto-exchange of this size is targeted, Benton explained that it “raises wider questions about how well the industry is equipped to protect digital assets and respond when things go wrong”.

He continued: “We’ve spent years talking about crypto adoption, innovation and the future of finance, but have we paid enough attention to protecting the assets themselves?

“The technology exists to trace stolen funds, however, the challenge is turning that intelligence into rapid, coordinated action before those assets disappear. It needs to be part of the infrastructure.”

Claud Bilbao, vice president of underwriting and distribution at Cowbell, noted that “the lesson reaches well beyond crypto” as few businesses could promise to absorb losses on such a scale.

He told Insurance Times: “A compromised laptop appears to have been at least one way in and the same basics apply everywhere – tight control of who has privileged access, multifactor authentication and proper checks on who can move money.

“Insurance works best as the backstop to those controls, not a substitute for them.”

’Sharpen underwriting’

The incident will most likely lead to “greater underwriting scrutiny” of crypto-exchanges, Choi noted.

He continued: “Underwriters will likely ask harder questions about the share of assets held in hot wallets – pooled wallets kept online to process withdrawals – privileged access and endpoint security for engineering staff and how any self-funded reserve is held and valued.

“Where those answers fall short, lowered limits or higher pricing would be a reasonable expectation.”

Echoing this view, Bilbao added that “an incident of this size will sharpen underwriting rather than close the door”.

No single policy or single insurer, he explained, is “built to absorb a multibillion-dollar theft” and, therefore, “meaningful protection will come from layered, multimarket programmes”.

“Beyond Binance, firms that hold funds on the exchange or depend on it, such as market makers and fintechs, could be disrupted by the suspension of deposits and withdrawals,” Choi finished.

“Whether that’s recoverable under dependent business interruption cover will come down to policy wording and how long Binance holds up the suspension.”