All sections Search
GLOBAL EDITION
Sign inEdition archive The Digital Insurer
Last news run:
insurewire.org
THE EVENING EDITIONInsurance. Risk. A changing world.
Evening edition / 30 October 2026Two editions a day, wire updated in between · How we report · The team

Home/Risk & Catastrophe

Risk & Catastrophe · News report

Binance estimates hack impact at $6.3bn

Crypto exchange Binance estimates the impact of a hack on its hot wallets at about $6.3bn, more than four times the previous record crypto theft, Insurance Business reported. Blockchain analysts link the attack to North Korea, which puts the Lloyd's requirement for state-backed attack exclusions in standalone cyber policies at the centre of any insurance recovery.

insurewire.org editorial desk
AI-assisted brief · Source checkedPublished · Source dated
Included in the evening edition of 30 October 2026
Illustration of server cabinets in a data room with one door open and an unplugged cable, beside a ledger on a desk.
Illustration generated with AI for insurewire.org. Not a photograph of the event.

Binance, the largest crypto exchange, estimates the total impact of a hack at about $6.3bn, Insurance Business reported on 30 October. The first large outflow from a Binance hot wallet came at 20:24 GMT on Thursday 29 October. The exchange paused withdrawals shortly after 22:00 and has since suspended all deposits and withdrawals. The figures are approximate and still changing. The previous record crypto theft was the $1.5bn taken from Bybit in February 2025.

Binance's preliminary investigation found that the attacker compromised the laptop of a DevOps engineer, used it to reach an internal service and submitted unauthorised withdrawals. Binance said it saw no evidence that private keys had leaked; at least one blockchain security firm disputed this. TRM Labs links the attack to TraderTraitor, the North Korean group that the FBI blamed for the Bybit theft.

About $3bn has been frozen, mostly by the stablecoin issuers Tether (about $1.57bn) and Circle (more than $800m). About $3.3bn remains free, including roughly $2.4bn in bitcoin and ether, which no issuer can freeze. Binance has promised to cover all losses from its Secure Asset Fund for Users (SAFU) and company funds. SAFU is held in bitcoin and covers less than a fifth of the estimated loss.

For insurers, attribution is the central question. Under Lloyd's Market Bulletin Y5381, standalone cyber policies written at Lloyd's since 31 March 2023 must exclude war and certain state-backed attacks and must state how an attack is attributed to a state. The publication noted that the test targets attacks of national scale, so it is arguable whether a theft from a private exchange qualifies, and insurers usually carry the burden of proving that a war exclusion applies. George Grimshaw of broker Clear Group said cyber cover is "not going to cover anything" for war or state-backed attacks.

Specialist crypto theft capacity exists, for example through Evertas and through Redefind, an MGA that WTW bought in June. But the reported limits are a small fraction of the loss. In the UK, the FCA's crypto authorisation gateway closes on 28 February 2027 and the new regime starts on 25 October 2027.

Read the source

Insurance Business (UK) ↗

News publisher · 30 Oct 2026

This is an original brief based on the linked publication. Company statements and forecasts are attributed to their source.

EuropeAsia-Pacific

Continue reading

All stories →
Illustration

Risk & Catastrophe

Aon puts nine-month insured catastrophe losses at $91bn, the lowest since 2019, and says 55% of economic losses were uninsured

Aon estimates that natural catastrophes caused at least $91bn of insured losses in the first nine months of 2026, the lowest total for the period since 2019 and well below the five-year average of $135bn. Economic losses were about $204bn, and Aon puts the protection gap at 55%. It expects fourth-quarter events, including Hurricane Isaias, to lift annual insured losses above $100bn.

2 min read

Illustration

Risk & Catastrophe

AM Best warns the PHP flaws could become a systemic cyber event, with losses reaching D&O cover

Rating agency AM Best says the critical PHP vulnerabilities disclosed this month could become a systemic event for cyber insurers, Carrier Management reported. It says insured losses could extend into directors' and officers' cover, because regulators in the EU and the US set reporting and patching requirements. AM Best also expects claims to emerge over a long period and a large gap between economic and insured losses.

2 min read

Illustration

Risk & Catastrophe

CyberCube expects PHP2Shell claims to arrive slowly, and Crawford warns that patching outages may not be covered

Cyber risk modeller CyberCube has sent clients a security incident report on the PHP2Shell flaws. It expects insurable losses from medium and large companies breached through unpatched servers, with claims that may appear weeks or months later, Insurance Edge reported. Separately, claims firm Crawford warned that taking systems offline to patch does not automatically create a covered loss.

3 min read

The daily briefing