What the Binance hack means for crypto capital

Binance, the world's largest crypto exchange, was hacked on Thursday, with about $6.3 billion drained from its hot wallets, the largest crypto theft to date.

Binance says a compromised engineer's laptop gave the attackers access to its withdrawal systems. On Saturday, the FBI attributed the attack to TraderTraitor, a North Korean hacking group. Binance began reopening withdrawals in phases early Sunday, which resulted in around $3.64 billion worth of net outflows, though Binance said the initial spike later abated.

Binance has pledged to cover losses from its own pockets, and has already readied $6.3 billion in capital to do so, but what does the hack mean for crypto capital more broadly?

Raising money has already been tough for early-stage startups and smaller funds for some time, and larger rounds have gone to only a few sectors and top-tier firms, many of which have expanded beyond crypto. Most recently, a16z Crypto, one of the industry's leading VC funds, rebranded as a16z Frontier, widening the fund's scope "beyond crypto startups." Now the Binance hack adds another worry.

"Venture funds and early-stage startups are less directly exposed, but [the hack] adds to a cautious funding environment where capital is already concentrating in fewer, stronger hands," said Andy Martinez, founder and CEO of Crypto Insights Group.

Why do big hacks keep happening?

Binance is the latest major crypto platform to get hacked. It follows Bitget's roughly $388 million breach in September, the roughly $292 million Kelp DAO exploit and the Drift exploit of around $285 million, both in April, and Bybit's roughly $1.5 billion hack last year, also attributed to North Korean hackers.

"Large hacks keep happening because the rewards are enormous and the attackers are well resourced," said Tom Robinson, co-founder and chief scientist at blockchain analytics firm Elliptic. "Exchanges have to defend every employee, supplier and system, whereas the attacker only needs one way in."

AI is making it easier to trick humans as well, Robinson said. “Fake recruiters, convincing messages and fake identities are cheaper to produce at scale. That matters because staff are the usual way in.”

But AI is also helping security researchers trace hacks faster. “We make extensive use of it at Elliptic,” Robinson said. “It helps us follow funds across blockchains and flag them to exchanges and issuers faster.”

Where will the Binance hack hit hardest?

Hedge funds have the most direct exposure. Of the managers that go through Crypto Insights Group's diligence process, 30% of directional open-ended funds and 61% of market-neutral open-ended funds list Binance as a counterparty, Martinez said. Among separately managed accounts, it's 67% for directional managers and 63% for market-neutral ones.

"When a venue this central has a problem, it is both an operational issue and an optics issue for a large part of the industry," he said.

Even if Binance repays everyone, a frozen venue can hurt in the meantime. A manager running cross-exchange arbitrage can have "one side of a hedged position locked while the other side keeps moving," and be "caught offsides through margin calls or forced unwinds, even if no customer funds are ultimately lost," Martinez said. Most institutional-grade managers have moved toward off-exchange settlement since FTX, he added, and "this event will push the rest in that direction."

“I don’t expect this to stop institutions that are already in diligence, but it will lengthen timelines and continue to raise the bar,” Martinez said. Experienced allocators are already asking where assets are held, how much sits on an exchange at any given time and what happens if a trusted venue fails, he added. “Managers with clean answers will keep raising. Those without them will find it harder.”

Karl-Martin Ahrend, co-founder and managing partner at crypto advisory firm Areta, is hearing similar questions from clients looking to close funding and M&A deals. "Parties in live negotiations are coming forward with additional questions about infrastructure architecture and security," he said. "Deals in advanced stages will likely be delayed as counterparties wait for the dust to settle."

He thinks the investors most likely to back off are the ones who never fully committed. "Where it will likely hurt is with generalist LPs who were already undecided about digital assets," Ahrend said. "Capital will keep flowing, but teams will now likely face a higher bar to convince more traditional investors."

Acquirers will also likely "price in 'unquantifiable security risks' more seriously in the near term," he said. Security businesses, meanwhile, could benefit. Ahrend expects more strategic investment and acquisition interest in wallet infrastructure, signing security, real-time threat monitoring, insurance-backed custody and blockchain analytics.

Did the industry's response limit the damage?

Tracing assets and freezing stolen crypto helped contain the fallout, sources said. "The industry's response limited the damage significantly," Robinson said. About $2.8 billion, or 44% of the theft, has been frozen, "far more than in any previous major hack,” he added. Tether froze the attacker's main wallet 37 minutes after the stolen USDT arrived. Circle, which has been criticized for slow freezes in past hacks, froze more than $800 million in USDC.

But the remaining $3.3 billion is in bitcoin, ether and XRP, "which no one can freeze," Robinson said. The frozen stablecoins could technically be reissued to Binance, he added, but issuers will want "a clear legal basis first," usually a law enforcement request or a court order confirming the rightful owner, and that process "can take weeks or months."

Geoffrey Kendrick, global head of digital assets research at Standard Chartered, said Binance's backstop shows how far the industry can regulate itself. "Binance is so large and has such deep pockets that in some ways it can self-regulate," he said, comparing it to the DeFi United effort that raised funds after the Kelp DAO hack.

Will TradFi pull back?

Robinson doesn't see the hack slowing traditional financial institutions' efforts to expand into crypto. "It is a reminder that custody is where the risk sits, and banks and asset managers already take that seriously," he said.

Ahrend sees it the same way. "An incident this serious tests that trust, but we don't think it reverses it," he said. Mastercard bought stablecoin firm BVNK for up to $1.8 billion for its regulated payment rails, "and that logic hasn't evaporated," though IPO timing could shift if markets stay volatile, he added.

Martinez isn't so sure. "One of the largest hacks on record matters to an investment committee trying to get crypto across the line," he said. "It increases the career risk and reputational risk for anyone recommending an allocation." He expects traditional institutions to stay "within familiar confines," with more managers looking to work with larger traditional custodians and exchanges.

Kendrick said regulation could help. "The lack of regulation around crypto increases the probability of hacks such as the Binance one," he said, adding that the Clarity Act "would have helped and would be a good way to increase investor protection."

What's ahead?

"This was a failure of operational controls, not of the underlying technology," Martinez said.

Robinson wants the industry to "treat security as a core function," with limits on hot wallet balances, controls that check what each transaction does, and "serious protection for staff who have access to critical systems." More than $3 billion of the stolen funds is still in the attacker's hands, he said, and laundering the Bybit funds took months. "Each time the funds move, there is a chance to catch them."

Lex Sokolin, co-founder and managing partner at Generative Ventures, pushed back on blaming the exchange. "That's like blaming a person who just got mugged for walking around at night," he said. "The people at fault are the thieves." He called on the industry to come together "to disable their infrastructure and ability to generate cash flow from continued criminal activity."

Ahrend sees a possible upside. "If the situation gets resolved smoothly, it may even serve as a case study for the robustness of the industry," he said.

The hack had a limited impact on crypto markets following an initial sell-off on Thursday. Bitcoin rose about 1.7% from Friday evening to around $78,100 by Sunday evening ET, while BNB gained a similar amount to about $710, according to The Block's price data.

To subscribe to the free The Funding newsletter, click here. And explore all The Block newsletters here.