El robo a Binance dispara la alarma sobre la seguridad 'cripto'

On Friday, a group of hackers launched a massive attack on Binance, the largest crypto exchange by user count, and stole 6.3 billion dollars, making it the biggest heist in crypto history. Experts attribute the issue not to technology, but to intermediaries. The Chinese-origin exchange faced a historic hack in the early hours of Friday. Initial estimates put the theft at 6.3 billion dollars (5.65 billion euros) in cryptocurrency. If confirmed, this would be the largest robbery in the history of crypto assets.

While the crypto world strives to improve, security remains its Achilles heel. Although experts emphasize that the problem lies not in technology, but in intermediaries, the source of the breach was traced to a laptop of an engineer. The hackers, presumed to be the North Korean group TraderTraitor, infiltrated the engineer's laptop and instructed the system to send funds to the attackers' accounts through ten different blockchains.

This incident highlights that the security perimeter of a crypto exchange extends beyond its wallets and crypto storage systems. A workplace, a privileged account, an internal service, or even an external dependency can become an entry point, according to Georgy Kucherin, a cybersecurity researcher at Kaspersky GReAT. Leif Ferreira, CEO of Bit2Me, adds that in the crypto sector, large-scale hacks rarely breach cryptography.

Instead, they target people and internal systems that authorize transactions. Therefore, the security of a custodian depends on both processes and technology.

Immediate steps following the attack are crucial, and companies must have contingency plans. First, contain the incident by isolating affected systems, revoking compromised credentials and permissions, and temporarily suspending withdrawals until secure processing is ensured. Next, traceability and asset recovery begin, highlighting the importance of collaboration between companies.

Binance rapidly blocked around 3 billion dollars, and the ecosystem contributed significantly. Tether froze approximately 1.57 billion dollars, Circle froze over 800 million dollars, and Ripple and other participants also intervened, totaling around 3 billion dollars. However, blocking funds does not mean they have been recovered. Identifying the attacker and locating the funds are different processes.

The attackers typically use sophisticated mechanisms to complicate tracking and unlink funds from their origin. However, not being able to identify the attacker today does not mean it cannot be done in the future. Crucial to this process are technological research and cooperation between platforms, asset issuers, and authorities, as emphasized by Sandra Adrián, CEO of Modo Cripto.

Now, it is especially important to understand the definitive technical report and verify the protection of all user assets after the incident, Santos advises. Binance has reserved more than 6.3 billion dollars in company funds to cover the incident. In Europe, contingency plans differ and are not left to individual companies. The MiCA regulation requires authorized providers to meet organizational, internal control, asset protection, and risk management requirements, along with digital resilience management obligations, Adrián explains.

Ferreira notes that DORA obliges crypto service providers authorized under MiCA to manage technological risk, test response and continuity plans, and report serious incidents to their supervisor.

Binance cannot operate in Europe without a MiCA license. Santos emphasizes that users should pay special attention to a platform's custody model, asset segregation, security controls, and offered guarantees. No one should assume a company is immune to such incidents simply because it is among the world's largest, Santos advises.

Ferreira recommends European investors always verify if a platform is authorized, as CNMV and ESMA records are public and free, indicating which crypto custodians are permitted. Ferreira also emphasizes that MiCA requires custodians to separate crypto assets from customer funds, even in case of insolvency, and holds them responsible for losses attributable to their negligence, up to market value.