$6.3bn Binance heist puts cyber risk on investors' radar

A $6.3bn (£4.7bn) theft from Binance, the world’s largest cryptocurrency exchange, on 30 October is the number that sets the past fortnight apart for anyone pricing cyber risk. The record heist, attributed to the North Korean state, was followed within days by an attack on Ukraine’s emergency alert app, which sent people in Kyiv a fake nuclear strike alert, and by an assault on commercial refrigeration systems that hit retailers across Belgium, Estonia, Ireland, Finland, Luxembourg, the Netherlands and Sweden, with some shop freezers soaring to 50C (122F). The pattern these incidents describe is one investors, operators and insurers cannot afford to ignore.

The fridge attack reached directly into commerce. Alex Pearce, who runs the fruit and vegetable wholesale business Langridge Organic in London, noticed the defrost light on refrigeration unit 2 glowing during his morning rounds last Monday, with the panel reading 150C. Unit 4 was the same, and as he approached his biggest unit, its defrost light also blinked on. He asked himself whether this was a cyber-attack, walked to the box connecting the units to the internet and pulled the cable. He was right. “If it had happened on a Saturday morning, when I don’t tend to be here, it could ultimately have led to a fire,” he said. French blood banks were also among the victims, and French supermarket fridges had been hit the previous month in what may have been a trial run.

Additional reference context is available at https://www.theguardian.com/news/ng-interactive/2026/nov/08/hot-fridges-a-fake-nuclear-alert-and-a-6bn-heist-are-we-in-the-foothills-of-a-hacking-epidemic.

The official message after these incidents is that more disruption should be priced in. Richard Horne, head of the UK’s National Cyber Security Centre, said this week that we are in the “foothills” of a new hacking landscape. Referring to flaws in IT systems being exposed by AI technology, he said: “There are so many vulnerabilities out there that … you could say are waiting to be exploited.” He added: “The most serious risk we face in the short term is just a huge rise in the volume of incidents … and I think you could probably point to the last few months and say we’ve started to see that.”

Meanwhile, the economics of the shift are becoming clearer for market watchers. Since April, when the AI startup Anthropic released its Mythos model, which has a startling ability to flag IT flaws, the number of vulnerabilities found by leading tech companies has soared eight-fold. Attacks have not risen by the same volume. The cybersecurity expert Tal Be’ery has speculated that criminal hackers are struggling to monetise these flaws, pointing to a recent decline in ransomware revenues. “It seems that currently the surge in vulns does not translate to a surge in breaches,” he wrote last month. Websites around the world were temporarily taken out of service as a precaution when AI from the ChatGPT developer OpenAI helped discover a flaw in PHP, the computer language used to build much of the world wide web, though Sophos, a leading cybersecurity firm, said it had seen no major incidents among clients, only a significant number of attempts to exploit the vulnerability.

Where do the costs land? The commercial refrigeration supply chain offers an answer. The hackers attacked the companies providing operating systems for commercial refrigeration units, systems connected to the internet that offer a remote access route to the ultimate victims. The Danish firm Danfoss, one of the affected providers, said most of the affected equipment was old and no longer received security updates, and that it had “long recommended” customers install updates or replace obsolete software. Pearce’s own monitoring system, by the US firm Copeland, was installed in 2018 and will now need updating, a capital cost arriving seven years early. “Have we learned a lesson? Yes,” he said. “There is a vulnerability we probably should have been aware of, but luckily the ramifications for us were not severe.”

Attribution matters for the geopolitical risk premium. At least one expert said the fridge attacks bear Russian hallmarks. Xavier Bellekens, chief executive of the cybersecurity firm Lupovis, set up “honeypot” traps using the same fridge controllers targeted in Europe; the lured hackers used internet service providers particularly tolerant of malicious activity, a tactic linked with previous Russian operations. “Are we certain they are Russian groups? We are not. But elements of this point in that direction,” he said. The Binance hack has been attributed to North Korea, whose crypto-hacking reputation is well established, and Russia is a natural suspect in the Ukraine incident.

Not everyone accepts the alarmist framing. Ciaran Martin, the NCSC’s founding chief executive, played down the “Wuhan moment” comparison made by the tech commentator Azeem Azhar, who likened AI models discovering exploitable flaws to China’s Covid ground zero. “It’s a bad run, but it’s not unprecedented,” Martin said, citing NotPetya and WannaCry in 2017 and the 2021 ransomware surge. “We are having one of those waves of incidents that happen every few years.”

Finland, which shares a 1,340km (832 mile) border with Russia, offers a measure of the trend. Its national cybersecurity centre recorded nearly 21,000 incidents last year among fewer than 6 million people, up from about 13,000 in 2022. This year hackers compromised up to 50,000 Finnish government mobile phones; last year they took down the defence ministry’s website. Samuli Bergström, vice-president of the Helsinki-based firm WithSecure, said attackers are “mostly opportunistic” and that any internet-connected device should be assumed to be a target eventually. The NCSC’s chief technology officer, Ollie Whitehouse, said manufacturers must invest more in security and consumers must be willing to pay for robust products and keep them updated. “To be worried, I think, is [too] strong. But we need to be more mindful, definitely,” he said. The UK’s Be Ready campaign, urging three days’ worth of food and up to nine litres of bottled water, and defence secretary Wes Streeting’s warning about “state-sponsored terrorism” targeting everyday infrastructure, underline that the cost of preparedness is now a line item for households and businesses alike, and whether insurers and vendors absorb it remains the open question for the year ahead.