The October 29 theft of $6.3 billion from Binance—described as the largest cryptocurrency theft ever—took minutes to execute after months of preparation, according to Binance’s initial investigation.

Experts say the attack exposed two linked weaknesses: social engineering can compromise a single employee, and poor internal controls can let an attacker expand access and move assets.

Crypto exchanges are especially attractive targets because attackers can identify wallets holding large, readily transferable sums and target the engineers or IT workers with access to them; defenders must resist repeated attempts, while attackers need only succeed once.

Experts are urging exchanges to strengthen safeguards with transaction limits, spending-pattern reviews, account controls and circuit breakers that can contain damage after credentials or a computer are compromised.

Some crypto advocates view automated reviews and transaction limits as threats to decentralization, privacy and resistance to censorship, but Jonathan Alexander of OpenZeppelin argued that security protections can coexist with those principles.

Exchanges have begun tightening defenses and sharing information following the hack, Reuters reported on October 30.

Alex Pruden of Project Eleven expects the breach to drive greater cybersecurity investment, including safeguards for internal AI tools and agents that could expand an attacker’s capabilities if compromised.

The Binance theft adds to more than $22.3 billion in cryptocurrency losses from hacks since 2021, according to Chainalysis, fueling calls for consistent cybersecurity standards and stronger investor protections.

Those calls come amid fragmented U.S. oversight: crypto exchanges face requirements that vary by state and location, unlike banks, which operate under federal cybersecurity requirements and continuing examinations by dedicated supervisors.

New York requires licensed crypto firms to maintain cybersecurity programs, use multi-factor authentication and designate a chief information security officer, while other state money-transmitter regimes may require reporting and examinations without specifying technical controls.