The $6.3 Billion Binance Hack Started With a Job Offer. Here’s What It Means for Your Cyber Policy.

While Falcon Forward typically does not cover news, the Binance hack warrants attention. Binance, a leading crypto platform, reported a $6.3 billion loss to hackers. Mike Tanghe, President of Falcon West, considers this the largest hack on record. This figure excludes lost business and investigation costs.

The scale is staggering. However, the method of the attack should concern every business owner.

The attackers did not force entry. Instead, they gained access by being hired.

The group behind the hack is believed to have previously tested Binance’s defenses, learning how the company responded and how its systems repelled attacks.

Next, they targeted an individual. Rather than bribing a Binance engineer, they recruited him. They established a fake recruiting firm, conducted video interviews, and spent weeks learning about his background and daily responsibilities. They then offered him a salary significantly higher than his current pay.

The final step was a “pre-job skills assessment,” requiring him to download software for their testing platform. This software was malware, granting the attackers access to Binance’s internal systems. They conducted small test transfers before ultimately stealing $6.3 billion within minutes. Although Binance had shutdown protocols, over half the funds were moved before they could be frozen.

“Every company just has to have this high degree of suspicion of what’s out there and how they’re trying to get me.”

Mike Tanghe

You don’t have to be Binance to be a target

Mike’s main takeaway is that not dealing in crypto does not guarantee safety. As AI accelerates and reduces the cost of attacks, every company should anticipate and plan for potential incidents. A cyber policy is essential, and its value extends beyond reimbursement.

When you notify your carrier of a breach, their response team is deployed immediately, as the insurer’s assets are also at risk. They have established protocols for containment, damage assessment, and mitigation. Without this support, you may be searching for a cyber defense firm during a crisis.

Binance’s self-insurance fund enabled its survival. Most companies lack such resources.

Binance maintained a $2 billion self-insurance fund and assured clients their assets would be protected. Mike believes this fund is key to Binance’s survival. For most companies, a similar loss would be catastrophic, jeopardizing both the business and its clients.

What’s next: AI exclusions

The Binance hack was not executed by AI, but rather through a patient, human-led plan. Nonetheless, the industry is preparing for AI-driven risks. Peter has learned that ISO has drafted AI exclusion forms, though they have not yet been released. Some anticipate that AI exclusions will make cyber coverage more expensive or restrictive.

Mike advises focusing on quality. Admitted carriers submit policy forms for state review and approval, reducing the likelihood of unexpected exclusions. Non-admitted carriers can add new forms to their quotes at any time. Following major events like COVID and 9/11, exclusions often emerged, so it is important to review every form carefully.

Mike also expects businesses to build in more redundancy, with backup setups for the day they can’t reach a network or their CRM. For most companies, business interruption is the real damage.

What to do now

• Ensure your cyber coverage is provided by a reputable carrier.
• Review the services included with your policy, such as response times and support contacts. These factors are as important as coverage limits.
• Carefully review policy forms and monitor for AI exclusions as policies renew through 2027.
• Prepare for potential outages of your primary systems.

If you would like your cyber policy reviewed, please contact your Falcon West Broker.

All Insights