How hackers steal crypto - and what they do with it

SAN FRANCISCO - The biggest cryptocurrency hack on record has raised fresh questions about the industry’s ability to protect digital assets and become part of mainstream financial infrastructure. Binance, the world’s largest crypto exchange, suspended withdrawals from its platform after a security breach affected an estimated US$6.3 billion worth of funds.Crypto exchanges have long been lucrative targets for hackers because they control huge pools of digital assets that can be transferred around the world rapidly, typically with a measure of anonymity. A barrage of cyber attacks has exposed decentralisation – once touted as one of crypto’s greatest strengths – as a vulnerability.Without central authorities to safeguard assets and absorb losses, crypto users are dependent on fragmented infrastructure that malicious actors keep finding ways to attack. Increasingly sophisticated artificial intelligence models are supercharging the ability of hackers to discover weaknesses to exploit.How common are crypto attacks?Crypto-related hacks have been getting larger and more frequent. Roughly US$1.2 billion was lost across 255 attacks from July to September, compared with US$822 million in 222 incidents from April to June, according to blockchain security firm CertiK. Before the Binance heist, the biggest publicly known crypto hack occurred at exchange Bybit in February 2025, in which attackers made off with almost US$1.5 billion in tokens.How do hackers target crypto?Some attacks rely on simple social engineering, where hackers trick humans into giving them access to private systems. They can gain entry through compromised accounts, stolen credentials or malware. Binance initially said the October incident may have involved a software developer’s compromised laptop, although it later flagged “additional points of breach”.Blockchain intelligence firms TRM Labs, Chainalysis and Elliptic have all pointed to North Korea as likely being behind the heist.There are more technologically sophisticated crypto attacks beyond social engineering. Hackers target weaknesses in the technology surrounding a blockchain – a digital ledger of transactions stored across a vast network of computers. This includes software flaws that let hackers get around security controls and weaknesses in bridges that connect different blockchains.A common method used by hackers is to steal cryptographic keys that authorise transactions, allowing attackers to move funds out of exchange wallets. Another weak point they target is so-called hot wallets – digital wallets that are connected to the internet and used for transactions. These are more vulnerable to cyberattacks than cold wallets, which keep the keys controlling crypto transactions offline.Cold wallets were once considered to be impregnable by criminals but they, too, are now being targeted. Attackers have tampered with hardware associated with these wallets, while software flaws in the devices have also exposed users to theft. In late July, hackers absconded with more than US$100 million worth of Bitcoin from thousands of wallets secured by hardware devices made by Canada-based Coinkite Inc. The attack exploited a software flaw that made it possible for hackers to figure out the private keys protecting the crypto.How do hacks on decentralised platforms happen? The Binance hack targeted a centralised exchange where a platform is acting as an intermediary for transactions. But crypto also has a decentralised-finance, or DeFi, ecosystem. This is essentially a network of blockchain-based protocols that employ self-executing code known as smart contracts to let users move crypto assets without relying on centralised intermediaries.DeFi creates a different set of vulnerabilities. Hackers can exploit flaws in the smart contracts’ code to manipulate prices or drain assets. They can also target private keys, cross-chain bridges and the infrastructure surrounding a protocol.The US$320 million hack of Liquid Network, a network connected to Bitcoin that allows faster transactions and settlement, was among the major crypto security breaches this year. Separate attacks on DeFi protocols KelpDAO and Drift Protocol in April together accounted for US$577 million in losses. Cross-chain links are a critical component of DeFi, enabling assets and information to move between separate blockchains. But a proliferation of cross-chain projects and a limited capacity for cybersecurity vetting has raised additional points of vulnerability.Can stolen funds be tracked, frozen and returned?Crypto can often be tracked surprisingly well.Transactions on public blockchains are permanently recorded, allowing investigators to follow stolen funds as hackers move them between wallets, cryptocurrencies and, increasingly, different blockchains.But tracking the money does not necessarily mean it can be stopped. Bitcoin and Ether, for example, do not have a central issuer that can simply freeze an attacker’s wallet. Centralised exchanges can block assets deposited on their platforms. And issuers of some stablecoins – crypto pegged to another asset such as the US dollar – have the ability to freeze tokens held at specified addresses. This includes Tether’s USDT and Circle’s USDC. But freezing has to be done quickly as attackers may try to swop assets that can be frozen for ones that cannot and move them across blockchains.Frozen does not mean recovered. Returning assets to their original owner may require cooperation from exchanges or token issuers, as well as potentially lengthy legal and law-enforcement processes. In some cases, hackers themselves have returned stolen assets, sometimes after negotiating a bounty.What was affected in the Binance hack?The funds drained included Bitcoin, Ether, dollar-backed stablecoins USDT and USDC, and a range of smaller tokens.Binance said that “user funds remain safe”. It pledged to cover all losses and said it has reserved more than $6.3 billion of company funds to do so. Some $5 billion is already held in the exact tokens that were impacted and the exchange is in the process of buying the remaining tokens from the market. Binance also said that around $3 billion of affected assets had been frozen on-chain and that it was working with law enforcement and partners to freeze and recover additional funds.While this is crypto’s biggest known hack, the amount involved is still relatively small compared with Binance’s overall size. Binance has about US$137 billion in on-chain assets, as tracked by analytics platform DefiLlama, nearly five times the roughly US$29 billion held by second-largest exchange OKX.Is it easy to turn stolen crypto into cash?Turning stolen crypto into fiat cash is often the hardest part, especially after a large public hack, because blockchain transactions can be traced and regulated exchanges can identify or freeze suspicious deposits. But hackers do not necessarily need to cash out immediately.Criminals increasingly use stolen crypto as a store of value or payment method, layering transactions through other services before attempting to reach an exchange, according to blockchain analytics firm Chainalysis. In the case of KelpDAO, the infiltrators used most of the crypto as collateral for borrowing on Aave, the biggest DeFi lending protocol. Hackers can also split stolen assets among numerous wallets, move them across different blockchains or send them through crypto mixers, which pool transactions to make the flow of funds harder to follow.Eventually, some may try to convert the assets into cash through exchanges or other intermediaries.What role does AI play in crypto hacking?Cyber criminals are getting better at scanning software for weaknesses and rapidly designing a mode of attack, which experts say likely reflects the help of widely available AI models. As AI becomes more sophisticated, it’s increasingly able to discover serious cybersecurity vulnerabilities. This has lowered the barrier to entry for would-be crypto thieves and enabled skilled attackers to find and take advantage of loopholes more quickly.AI isn’t just a useful tool for hackers to engage in sophisticated code exploits. It can also allow the more mundane social-engineering side of crypto hacking to be conducted at a larger scale, producing convincing phishing messages, impersonations and other material used to steal credentials or obtain access. BLOOMBERG