The largest crypto theft on record took about 20 minutes. Binance says it will cover every loss. The lawyers are less sure that promise is worth the paper it is not written on.
LawFuel |John Bowie
The crypto hackers may have stolen $6.3 billion in minutes, but the legal action could take years as the world’s largest heist creates digital and legal shockwaves around the world.
Late on 29 October (US time), Binance, the world’s largest cryptocurrency exchange, disclosed that attackers had submitted unauthorised withdrawals affecting about $6.3 billion in assets. Blockchain analytics firm TRM Labs puts the figure at $6.36 billion, moved across ten blockchains, most of it within roughly 20 minutes, which happens to be about four times the previous record, the $1.5 billion Bybit hack of February 2025.
TRM says it attributes the attack “with high confidence” to TraderTraitor, a North Korea-linked group it also blames for Bybit. Chainalysis and Elliptic point the same way. No government has yet confirmed the attribution.
About $3 billion has been frozen on-chain, helped by stablecoin issuers including Circle and Tether, along with Ripple. Binance has suspended withdrawals and says it will cover all losses from its Secure Asset Fund for Users (SAFU) and company funds, which lawyers may or may not agree is going to work.
A promise is not a contract
Edwin Coe’s disputes team was quick to point out the gap between what Binance has said publicly and what it has agreed to contractually.
“Customers should not regard this as legally binding,” said Alexander Shirtcliff, the firm’s head of commercial disputes and class actions. He noted that Binance’s standard user terms limit its liability to customers and contain no commitment to use the SAFU fund at all.
His colleague Daniel Tunkel, (above) head of financial regulation, was more blunt as he said “blandishments from the Board of Binance” with what individual customer terms actually say, and described a Binance hack as something of an accident waiting to happen.
The practical questions follow quickly.
Which Binance entity did the customer contract with? Which version of the user agreement applied? Which court, or tribunal, has jurisdiction? Binance’s terms have previously sent disputes to arbitration in Hong Kong, which would complicate any class action plans considerably.
Crypto prices moved sharply on the news, with Bitcoin falling more than 4% on the day. Reimbursement “in full” invites the question: valued when, and in what?
Shirtcliff flagged that how Binance decides to distribute funds, to whom and when, could itself become a dispute.
If compensation falls short, collective action is the obvious next step, and the infrastructure already exists.
A UK group claim against Binance and Changpeng Zhao, run by KP Law over unauthorised derivatives sales, has gathered around 2,700 claimants and claims estimated at more than £250 million.
Litigation funders have form here too. In 2021, Liti Capital committed at least $5 million to fund an arbitration against Binance, with White & Case acting for claimants.
Don’t wait for the exchange
Pinsent Masons is pushing a different course of action, say investors with serious money at stake should act now rather than wait for Binance, or the police, to finish investigating.
“The critical issue is speed,” said Hinesh Shah, (left) a forensic accountant and partner at the firm. Stolen crypto moves rapidly across wallets, platforms and borders.
His advice is to consider court applications to trace and freeze assets before they move beyond reach.
The English courts, at least, are well practised in such matters. As far back as 2021, the High Court ordered Binance itself to help identify hackers and freeze their accounts after a $2.6 million theft from one user. Persons unknown freezing orders and disclosure orders against exchanges are now routine tools in London’s commercial courts.
Frozen is not recovered
Freezing about half the haul is a genuine achievement. Recovering it is another matter.
Stablecoins are the easy part as issuers can freeze tokens and, in principle, reissue them. Native assets that have already been moved or swapped are much harder and every frozen wallet raises the same question of where is the money now? Stolen crypto can pass through many wallets before anyone flags it.
A trader who received tainted assets in good faith may find them frozen. The courts will not freeze first and ask questions later. n Piroozzadeh, the High Court discharged an interim proprietary injunction against Binance, showing judges will weigh the exchange’s position and third-party interests.
The North Korea link adds a sanctions layer. Any lawyer handling assets that may trace back to a designated actor will want sanctions advice before touching them.
One laptop, ten blockchains
For law firms, the most uncomfortable part of this story is how it reportedly began.
Binance’s initial investigation suggested a compromised DevOps engineer’s laptop gave the attacker access to a service container that could submit withdrawal transactions.
Co-CEO Richard Teng (above) later described a more complex attack with broader breaches, including a self-destruct mechanism that destroyed tooling and tracers. The full post-mortem is still to come.
Ellie Ludlam, a cyber and insurance partner at Pinsent Masons, says it is not yet clear whether the engineer was socially engineered. But her firm is seeing more breaches that start exactly this way, often with attackers posing as the IT service desk.
Law firms will recognise the pattern. They hold client money, deal data and privileged documents, and they run on busy people taking calls from “IT”. The sums are smaller. The vulnerability is not.
Who gets the work
The legal market reacted swiftly to the heist – within a day of the disclosure, at least two UK firms had commentary out about the event and the briefs and legal swat teams were being set up.
The likely winners are those with specialist skills in asset recovery and civil fraud, sanctions specialists, cyber and insurance advisers, claimant firms and the funders behind them. If Binance pays in full and on time, much of this will fizzle, but if it does not, it becomes one of the larger collective claims crypto has produced.
The hackers worked at blockchain speed but don’t expect the courts to do the same thing. Binance’s promise to make customers whole may well be honoured, but a promise made on X is not a contract, and the lawyers know that only too well.
FAQ
How much was stolen in the Binance hack? About $6.3 billion according to Binance, and $6.36 billion according to TRM Labs, moved across ten blockchains in roughly 20 minutes. About $3 billion has been frozen.
Who was behind the Binance hack? Blockchain analytics firms including TRM Labs, Chainalysis and Elliptic have linked it to TraderTraitor, a North Korea-linked group. No government has officially confirmed the attribution.
Is Binance legally obliged to compensate customers? Binance has publicly pledged to cover all losses. Lawyers at Edwin Coe say that pledge may not be legally binding, because the standard user terms limit Binance’s liability and do not commit it to using its SAFU fund.
Can Binance customers sue? Possibly. Rights depend on which Binance entity the customer contracted with, which version of the terms applied, and any arbitration clause. Collective action has been suggested if compensation falls short.
What should investors with large losses do? Pinsent Masons advises them not to wait for the exchange or police, and to consider court orders to trace and freeze stolen assets quickly.
What does the Binance hack mean for law firms? The breach reportedly began with a compromised engineer’s laptop. Cyber specialists warn that social engineering, including fake IT helpdesk calls, is a growing entry point that law firms also face.
