[Editorial] Binance heist should be South Korea’s wake-up call about crypto security

Binance’s logo. (AFP/Yonhap)

Hackers drained US$6.3 billion from Binance, the world’s largest cryptocurrency exchange, on Thursday. It was the largest crypto heist on record, and the FBI has named a North Korean hacking group as the culprit.

Stolen crypto is notoriously hard to trace, yet South Korea has failed to establish even legal safeguards for victims. The country can no longer afford to delay action.

The entire theft took just 20 minutes. Binance assembled a 100-member crisis response team as soon as it detected signs that US$1 billion was flowing out, but there was little it could do. Executives were reportedly left to watch as the losses mounted. 

Because a blockchain is a ledger anyone can view, outside analysts watched the money drain away in real time. Stablecoin issuers moved quickly to freeze funds, but the hackers had already converted around US$2.4 billion into assets that cannot be frozen and got away. It was a heist movie come to life. 

The crypto industry has long touted distributed ledger technology for making records virtually impossible to forge or tamper with. But a secure ledger does not make for a secure exchange. Once hackers gain control of withdrawal and signing privileges, they can move funds through what appear to be entirely legitimate transactions.

The Binance breach has been traced to a compromised laptop belonging to an engineer in charge of development and operations. The very feature that allows crypto to move across borders in minutes works just as well for criminals. And with attacks now harnessing artificial intelligence, the threat has only grown.

South Korea is no exception. In the string of hacks that recently swept through the country’s banks, brokerages, insurers and other financial firms, the first confirmed loss of actual assets came at a crypto exchange. Pravang, a coin-to-coin exchange, lost around 100 million won (US$75,000) when its hot wallet was hacked. Before that, in November 2025, around 44.5 billion won (US$30 million) worth of crypto was transferred out of Upbit without authorization.

Under the Electronic Financial Transactions Act, crypto exchanges are not classified as financial companies and therefore are not subject to the security requirements imposed on banks and brokerages. Nor are there rules defining the scope of an exchange’s liability or who bears the burden of proof when a hack occurs, so it falls to users to prove the exchange was at fault. 

Exchanges are required to carry insurance or set aside reserves, but the amounts involved are small, and exchanges are not even obligated to report breaches immediately. The government pledged to enact the Digital Asset Basic Act, which would address these gaps, by the end of the year, but it has yet to even finalize its own draft.

The number of crypto user accounts in South Korea has topped 11 million. Security oversight must extend beyond custody wallets to development and operating environments and the devices employees use for work, and security standards for exchanges must be raised to the level required of financial companies. Legislation that spells out exchanges’ liability for damages and their duty to report breaches cannot be put off any longer.