The staggering irony of the Binance hack

When he was serving jail time in 2024, the crypto exchange billionaire Changpeng Zhao wrote a book with a modest title: Freedom of Money: A Memoir of Protecting Users, Resilience, and the Founding of Binance.

The tome was short on introspection. A $US50 million ($71.2 million) personal fine, $US4.3 billion company penalty and four-month stretch in prison for failing to run an effective anti-money laundering scheme were like water off a duck’s back.

In one irony-free observation, Zhao wrote of being in jail that “the entire process was designed to deliver the lowest possible customer satisfaction.”

The book did little too to explain how Binance, the world’s largest crypto exchange, has protected its users, except where that is a byproduct of its own rapid growth. Since last Friday, when hackers stole $US6.3 billion in tokens from his website, Zhao has had a chance to turn his words into reality.

If Binance’s announcements since the hack are to be believed, the former chief executive has done a good job of compensating, if not protecting, his users. After a feverish weekend of work, Binance announced on Monday that it had covered 95 per cent of the stolen tokens by value through its unfortunately named SAFU – Security Asset Fund for Users – program and resumed withdrawals.

That may turn out to be the easy part. If Binance is to actually get back the billions in tokens that were stolen, Zhao will have to hope that other cryptocurrency companies have better anti-money laundering processes than his firm once did.

According to the FBI, the heist was likely carried out by a North Korean hacking group known as TraderTraitor. Early indications suggest that once the hackers started moving tokens, the entire $US6.3 billion was pulled out within half an hour.

At that point, much of the haul was in stablecoins such as Tether and Circle, which are designed to track the price of another asset, such as the US dollar. But the hackers rapidly started exchanging those tokens for truly decentralised alternatives, such as Bitcoin and Ethereum. The difference is that Tether and Circle can be frozen by the tech companies that created them; Bitcoin and Ethereum are the wild west.

The cryptocurrency tracking company Chainalysis noted that about half of the stolen coins were frozen by law enforcement and industry players before that could happen. That has put all eyes on the remaining $US3.3 billion worth of coins, which are now pinging between different cryptocurrency platforms, wallets and coins as the hackers try to avoid the watching eyes of law enforcement and crypto analysis companies.

Their likely end goal? Convert the money into traditional currency, such as US dollars or Chinese yuan, that the North Korean regime can actually use. Cryptocurrency thefts are perfect for that purpose. Where a traditional hack – and North Korea has executed several, including the Wannacry breach that hit the UK’s National Health Service or the 2014 Sony Pictures attack – might result in the release of sensitive data, mass disruption or a ransom payment in the millions, targeting a big crypto exchange can net billions.

In his book, Zhao frames his jail time as a disproportionate punishment for a minor record keeping issue. The US government disagreed, arguing in court that Binance had failed to stop hundreds of millions of dollars in unlawful transactions, including for sanctioned Iranian entities and drug traffickers.

Zhao has since been pardoned by US President Donald Trump. He may have moved on, but to stop Binance users’ stolen funds being swapped for traditional money, Zhao needs other cryptocurrency exchanges to do much better at detecting malicious users than Binance did – at least in the past.

The Market Recap newsletter is a wrap of the day’s trading. Get it each weekday afternoon.