Crypto attack expert: “Three billion are definitely gone”

Interview IT expert on the crypto hacker attack “Three billion are definitely gone” As of: October 30, 2026 • 1:32 p.m

The hacker attack on the Binance crypto exchange involves billions of dollars in digital currencies. Cybersecurity expert Mirko Ross explains why the trail leads to North Korea and what investors should consider.

ARD financial editorial team: Binance - the largest crypto exchange - speaks of a security incident with an estimated total damage of 6.3 billion dollars. What happened according to current information?

Mirko Ross: What we know is that there was a massive withdrawal of cryptocurrencies from Binance last night. These were transferred to other addresses, and - if you can believe the first reports and reports - the attack was by state hackers from North Korea. You could now freeze a part at the respective addresses. But three billion are definitely gone.

About Mirko Ross is the founder and CEO of asvin, a company that specializes in cyber risk management. As a teenager, he was active as a hacker before switching to the cybersecurity field. He worked on numerous advisory committees of the EU Commission, federal authorities and the Bundestag. Employee laptop as a gateway for hackers? ARD financial editorial team: The company itself claimed on the online platform X that the attack could have taken place via an IT employee's laptop. How should you imagine that?

Ross: First of all, with a crypto exchange like Binance, large values ​​are not simply transferred from the Binance wallets - their treasure chest, so to speak - to other addresses. Such systems are secured and so-called certificates are issued there. These are essentially keys that allow such a transaction. All we know so far is that the attackers had access to this Binance key system and were able to have their own transactions approved.

ARD financial editorial team: And what does that have to do with the employee’s laptop?

Ross: It could be that a developer who also needs keys or who perhaps works on this key system was a source of entry for the attackers with his compromised laptop. But you really have to look at it more closely later, how it happened in detail.

The world's largest crypto exchange Binance has apparently fallen victim to a massive cyber attack. more

ARD financial editorial team: According to the analysis company TRM Labs, the attackers are said to have moved the majority of the affected cryptocurrencies within just 20 minutes. How is this technically possible so quickly?

Ross: The entire Binance system is designed to make transactions very quickly and in large volumes. This explains why such large volumes of cryptocurrencies were able to flow out so quickly, because the system first has to be able to do the principle. Which is of course a problem: It was 20 minutes in which there was a lot of activity.

But the attack lasted longer, several hours. The attackers first made test transactions, but they did not immediately clear out the locker. So there was more activity over a longer period of time, and that's obviously worrying that this activity wasn't noticed.

ARD financial editorial team: The analysis company TRM Labs blames a North Korean hacker group for the attack. What do we know about this group?

Ross: North Korea actually has a hacker group that has specialized in stealing cryptocurrencies for years - from both investors and crypto bosses. And we see that there are crypto recipient addresses from past attacks that were attributed to North Korea that have now also been identified in the current Binance case. This suggests that the same hacking groups are active here.

Cybercrime against companies and private individuals represents an ever-increasing risk. Particularly dangerous: AI. more

ARD financial editorial team: What could have been the motive for the attack?

Ross: $6.3 billion is a great source of income for North Korea - even if only half of it is going through now and half could perhaps be stopped again in various infrastructures. Three billion is also a word. The German finance minister would also be happy about that.

ARD financial editorial team: There have been attacks like this in the past, although not on such a scale. Should we expect such cyber attacks more frequently in the future - including on crypto exchanges?

Ross: The number of cyberattacks is increasing, and cyberattacks on crypto exchanges are of course lucrative. Why? We are talking about high assets here. We have seen this in the past and we will see it in the future as well. This means for investors who are active in this crypto world: They have to pay much more attention to how they protect their own cryptocurrencies.

Who pays the damage if AI agents break into someone else's IT? In some cases this is new legal territory. more

ARD financial editorial team: And how can you protect yourself well?

Ross: The classic tip is always diversification. So, where do I have assets? And the second thing is: If I own cryptocurrencies and don't want to actively trade them, then I should urgently move these currencies to a so-called cold wallet. These are special cryptocurrency wallets that are not connected online, making them safe for hacking.

ARD financial editorial team: In recent months we have also increasingly talked about hacker attacks using AI. Do you think that this also has relevance, especially with regard to crypto exchanges?

Ross: There is currently no evidence that AI actively helped carry out this attack. It looks like a very classic method. The attackers had very special knowledge of this. But what we see of course: AI helps in the analysis of the incident to uncover the ways of concealment and to show which address and which account do these specific cryptocurrencies actually end up in?

The interview was conducted by Michelle Goddemeier, ARD financial editor.

This topic in the program: tagesschau.de | Hacker attack on crypto exchange Binance | 10/30/26 | 1:00 p.m