If Crypto Is Decentralised, Who Gets To Freeze Stolen Money? One Of Many Questions Raised By Binance’s $6.3 Billion Hack

October has been one hell of a month for cybersecurity. With Cybersecurity Awareness Month shining a spotlight on the importance of protecting our digital infrastructure, we’ve been given two rather timely reminders of just how vulnerable that infrastructure can be.

First, we had a critical PHP vulnerability that exposed weaknesses in software underpinning a huge proportion of the internet, up to 70% of websites, triggering millions of attempted exploits. Now, crypto’s in the firing line, with Binance currently dealing with a reported $6.3 billion hack, potentially one of the largest crypto thefts on record.

These incidents are quite different, but they do come together to raise serious questions about the security of the internet and digital assets, and how well organisations are protecting the systems we increasingly depend on. And the Binance attack in particular introduces another very interesting question which is, if cryptocurrency is supposed to be decentralised (pretty much its core premise), who actually has the power to freeze stolen money?

Two Cybersecurity Wake-Up Calls In One Month (Two Too Many?)

The PHP vulnerability, reported by The Guardian and plenty of other publications on 22 October, exposed a serious weakness in software used across a huge proportion of the internet. Security researchers identified millions of attempts to exploit the flaw, with the US National Security Agency warning that attackers could potentially take control of web servers, steal sensitive information and disrupt services.

Governments and businesses all over the world responded by temporarily taking websites offline to apply patches. In the UK, 32 government services were taken offline as a precaution, while the National Cybersecurity Centre issued 50,000 alerts to affected organisations.

The incident also highlighted how artificial intelligence is changing the cybersecurity landscape. Researchers used AI tools to help identify and demonstrate the PHP vulnerabilities, reducing the time and complexity involved in developing an exploit.

And now, a matter of days later, Binance has announced that an attacker had stolen approximately $6.3 billion in digital assets. The exchange’s initial investigation pointed to a compromised DevOps engineer’s laptop, although it has since identified additional points of breach.

Binance has said it will cover all losses and that customer funds are safe. It has also worked with blockchain partners to freeze approximately $3 billion in affected assets.

If Crypto Is Decentralised, Who Gets To Freeze Stolen Money?

One of the most interesting components of this story, other than the massive amount of money in the mix, is the fact that it highlights a massive contradiction at the heart of cryptocurrency. That is, digital currencies are often associated with decentralisation, removing the need for traditional financial intermediaries. In fact, it’s pretty much the biggest selling point of many digital currencies. However, some of the assets involved in the Binance incident were stablecoins, which are issued by companies that retain certain controls over their tokens.

Tether and Circle, for example, have been able to freeze affected assets issued through their respective stablecoin networks, according to The Guardian. This has helped restrict the movement of some stolen funds, but it also demonstrates the fact that centralised organisations still hold considerable influence over parts of the crypto ecosystem.

Chris Dimitriadis, Chief Global Strategy Officer at ISACA, says the incident has implications for trust in cryptocurrency more broadly. “This incident affects trust in cryptocurrency as a whole,” he says. He also warns that the consequences extend beyond the money itself. “The fallout from an incident like this goes far beyond the money stolen – market confidence drops, customers move their assets elsewhere and regulators start asking questions.”

Phoebe Hodgson, Banking and Payments Senior Analyst at GlobalData, believes the attack clearly shows how criminals are increasingly targeting the trust built into financial systems: “Attackers are no longer focused solely on breaking into systems or stealing customer data. They are increasingly seeking to exploit the trust embedded within financial infrastructure, turning legitimate access and transaction processes into mechanisms for moving money.”

Is Cybersecurity Keeping Up?

Considering these two incidents together, the PHP vulnerability and Binance hack highlight two different sides of the same problem. One exposed a weakness in widely used internet infrastructure, while the other demonstrated how a compromise within a major financial platform could lead to enormous losses.

For Hodgson, organisations need to rethink how they measure cybersecurity success. “The real challenge is that sophisticated attackers do not necessarily need to defeat every security control. They only need to find one trusted pathway that allows them to operate undetected.”

Dimitriadis makes a similar point, arguing that security cannot simply be left to technical teams: “This is ultimately a governance question, and it belongs in the boardroom, not just the security team.”

October’s cybersecurity awareness campaigns are intended to encourage better habits and stronger protection, but these incidents suggest awareness alone is not enough. Organisations need to understand what they depend on, where their vulnerabilities lie and how they will respond when something goes wrong, and although it may be a little ironic, Cybersecurity Awareness Month may be the perfect time for these issues to come to light.  Because as more of the world’s money, services and everyday infrastructure move online and into the digital realm, the consequences of a cybersecurity failure are becoming increasingly difficult to contain.