Could Any U.S. Rulebook Have Stopped the $6.3B Binance Hack?

The Binance hack was described as a $6.3 billion attack that took about 20 minutes. Taylor Monahan said it reflected North Korea’s growing sophistication: in some recent heists, attackers spent weeks inside systems and manipulated them into actions that should not be possible, rather than simply stealing compromised keys.

Monahan was skeptical that any U.S. rulebook or offshore registration could prevent this kind of attack. Regulation may encourage safer practices, she said, but it cannot be relied on to stop North Korean hackers. She also expects them to increasingly target traditional banks, fintechs and neobanks, not only crypto companies.

The response to the Binance incident became an industry-wide effort, with token and protocol projects taking steps they considered technically feasible. The host cited roughly $3 billion in stablecoins frozen within 45 minutes. Monahan called Tether and Circle’s response nearly instant and said the amount frozen exceeded the entire Bybit hack, which she described as the largest hack to that point.

Projects suspected North Korea in the initial hours and treated the incident as a problem for the wider industry, not just Binance. Monahan said coordinated action could reduce the attackers’ expected proceeds from a roughly $6 billion heist, though she did not know whether earlier incidents had prompted a similar response.

A provision in the CLARITY bill that would let stablecoin issuers freeze assets without a court order could make law enforcement’s work easier, the speakers said. Monahan noted that FBI and DOJ staff spend substantial time obtaining freeze orders and following up. She also cautioned that making freezes easier should not create new risks or bad incentives.

To reduce the risk of North Korean IT workers posing as employees, Monahan recommended meeting candidates in person and using the FBI’s “identity in depth” approach rather than relying on a single interview, document or check. Employers should revisit identity verification over time and check that laptop delivery details make sense: helpers may pose for interviews or provide identification, and workers may later change shipping addresses.