How hackers steal crypto - and what they do with it
SAN FRANCISCO -
asserted
they → steal → it
The biggest cryptocurrency hack on record has raised fresh questions about the industry’s ability to protect digital assets and become part of mainstream financial infrastructure.
asserted
hack → raise → infrastructure
Binance, the world’s largest crypto exchange, suspended withdrawals from its platform after a security breach affected an estimated US$6.3 billion worth of funds.
asserted
breach → suspend → funds
Crypto exchanges have long been lucrative targets for hackers because they control huge pools of digital assets that can be transferred around the world rapidly, typically with a measure of anonymity.
asserted
that → control → anonymity
A barrage of cyber attacks has exposed decentralisation – once touted as one of crypto’s greatest strengths – as a vulnerability.
asserted
barrage → expose → vulnerability
Without central authorities to safeguard assets and absorb losses, crypto users are dependent on fragmented infrastructure that malicious actors keep finding ways to attack.
asserted
actors → safeguard → ways
Increasingly sophisticated artificial intelligence models are supercharging the ability of hackers to discover weaknesses to exploit.
asserted
models → supercharge → weaknesses
Crypto-related hacks have been getting larger and more frequent.
asserted
hacks → relate → ?
Roughly US$1.2 billion was lost across 255 attacks from July to September, compared with US$822 million in 222 incidents from April to June, according to blockchain security firm CertiK.
Before the Binance heist, the biggest publicly known crypto hack occurred at exchange Bybit in February 2025, in which attackers made off with almost US$1.5 billion in tokens.
uncertain
attackers → lose → tokens
How do hackers target crypto?
asserted
hackers → target → crypto
Some attacks rely on simple social engineering, where hackers trick humans into giving them access to private systems.
asserted
hackers → rely → systems
They can gain entry through compromised accounts, stolen credentials or malware.
asserted
They → gain → accounts
Binance initially said the October incident may have involved a software developer’s compromised laptop, although it later flagged “additional points of breach”.
uncertain
it → say → breach
Blockchain intelligence firms TRM Labs, Chainalysis and Elliptic have all pointed to North Korea as likely being behind the heist.
asserted
firms → point → heist
Hackers target weaknesses in the technology surrounding a blockchain – a digital ledger of transactions stored across a vast network of computers.
asserted
Hackers → target → computers
This includes software flaws that let hackers get around security controls and weaknesses in bridges that connect different blockchains.
asserted
that → include → blockchains
A common method used by hackers is to steal cryptographic keys that authorise transactions, allowing attackers to move funds out of exchange wallets.
asserted
attackers → use → wallets
Another weak point they target is so-called hot wallets – digital wallets that are connected to the internet and used for transactions.
asserted
that → target → transactions
These are more vulnerable to cyberattacks than cold wallets, which keep the keys controlling crypto transactions offline.
asserted
which → keep → transactions
Cold wallets were once considered to be impregnable by criminals but they, too, are now being targeted.
Attackers have tampered with hardware associated with these wallets, while software flaws in the devices have also exposed users to theft.
In late July, hackers absconded with more than US$100 million worth of Bitcoin from thousands of wallets secured by hardware devices made by Canada-based Coinkite Inc.
asserted
hackers → consider → devices
The attack exploited a software flaw that made it possible for hackers to figure out the private keys protecting the crypto.
asserted
hackers → exploit → crypto
How do hacks on decentralised platforms happen?
asserted
hacks → happen → platforms
The Binance hack targeted a centralised exchange where a platform is acting as an intermediary for transactions.
asserted
platform → target → transactions
But crypto also has a decentralised-finance, or DeFi, ecosystem.
asserted
crypto → have → ecosystem
This is essentially a network of blockchain-based protocols that employ self-executing code known as smart contracts to let users move crypto assets without relying on centralised intermediaries.
asserted
users → base → intermediaries
DeFi creates a different set of vulnerabilities.
asserted
DeFi → create → vulnerabilities
Hackers can exploit flaws in the smart contracts’ code to manipulate prices or drain assets.
asserted
Hackers → exploit → assets
They can also target private keys, cross-chain bridges and the infrastructure surrounding a protocol.
asserted
They → target → protocol
The US$320 million hack of Liquid Network, a network connected to Bitcoin that allows faster transactions and settlement, was among the major crypto security breaches this year.
asserted
that → connect → breaches
Separate attacks on DeFi protocols KelpDAO and Drift Protocol in April together accounted for US$577 million in losses.
Cross-chain links are a critical component of DeFi, enabling assets and information to move between separate blockchains.
But a proliferation of cross-chain projects and a limited capacity for cybersecurity vetting has raised additional points of vulnerability.
asserted
proliferation → account → vulnerability
Can stolen funds be tracked, frozen and returned?
asserted
funds → steal → ?
Crypto can often be tracked surprisingly well.
asserted
Crypto → track → ?
Transactions on public blockchains are permanently recorded, allowing investigators to follow stolen funds as hackers move them between wallets, cryptocurrencies and, increasingly, different blockchains.
But tracking the money does not necessarily mean it can be stopped.
asserted
it → record → money
Bitcoin and Ether, for example, do not have a central issuer that can simply freeze an attacker’s wallet.
asserted
that → have → wallet
Centralised exchanges can block assets deposited on their platforms.
And issuers of some stablecoins – crypto pegged to another asset such as the US dollar – have the ability to freeze tokens held at specified addresses.
asserted
issuers → block → addresses
This includes Tether’s USDT and Circle’s USDC.
asserted
This → include → USDT
But freezing has to be done quickly as attackers may try to swop assets that can be frozen for ones that cannot and move them across blockchains.
uncertain
that → have → blockchains
Frozen does not mean recovered.
asserted
Frozen → freeze → ?
Returning assets to their original owner may require cooperation from exchanges or token issuers, as well as potentially lengthy legal and law-enforcement processes.
uncertain
Returning → return → exchanges
In some cases, hackers themselves have returned stolen assets, sometimes after negotiating a bounty.
asserted
hackers → return → bounty
…and 20 more, not listed.
The Aporia
