Binance founder Changpeng Zhao, widely known as CZ, has stated that traditional banks may face higher risks from cyberattacks than cryptocurrency exchanges.
His comments come just days after Binance suffered a record $6.3 billion theft, the largest cryptocurrency heist in history.
The attack, attributed by the FBI and blockchain analytics firms to the North Korean-linked group TraderTraitor, unfolded rapidly. Hackers drained assets across multiple blockchains in roughly 20 minutes.
Register for the next Tekedia Mini-MBA.
Register for Tekedia AI in Business Masterclass.
Join Tekedia Capital Syndicate and co-invest in great global startups.
Binance’s initial investigation pointed to a compromised DevOps engineer’s laptop that allowed unauthorized access to transaction systems, rather than a breach of private cryptographic keys.
The exchange has since said the incident involved a more complex attack with additional points of entry.
Binance moved quickly to cover user losses using company funds and its Secure Asset Fund for Users, freezing or recovering roughly half the stolen assets with industry partners and restoring normal operations.
In the wake of the incident, CZ argued that crypto platforms are frequent targets precisely because of their visibility and the irreversible nature of blockchain transactions.
He suggested banks could be more vulnerable overall, particularly as artificial intelligence amplifies threats such as sophisticated phishing and social engineering.
Industry observers note key differences in how breaches play out. Crypto thefts are highly public and difficult to reverse once funds move on-chain. Banks, by contrast, often have mechanisms to reverse fraudulent transfers, contain losses, or keep certain incidents less visible.
A 2024 IMF report highlighted banks as frequent targets within the financial sector, with substantial reported losses over two decades. Some analysts counter that the finality and high value of crypto holdings make exchanges especially attractive, while others argue crypto simply cannot hide its incidents the way traditional institutions sometimes can.
CZ has also emphasized that no system is fully secure and that prolonged periods without major incidents can breed complacency. He has called for greater industry collaboration, including a potential security alliance for sharing practices, cross-audits, and faster coordination on freezing stolen funds.
Contrary to the perception that cryptocurrency exchanges are the primary targets of financial cybercrime, traditional banks account for a significant proportion of reported attacks.
According to the International Monetary Fund (IMF), almost one-fifth of reported cyber incidents over the past two decades affected the financial sector, with banks emerging as the most frequently targeted institutions, followed by insurers and asset managers.
The IMF also reported that financial institutions recorded nearly $12 billion in direct losses from cyber incidents between 2004 and 2023. These figures demonstrate the scale of cybersecurity threats facing traditional financial institutions, particularly as banking operations become increasingly dependent on digital infrastructure.
Banks hold enormous volumes of customer information, process millions of daily transactions and maintain interconnected payment systems. This makes them attractive targets for cybercriminals seeking to steal funds, obtain sensitive information or disrupt financial services.
The IMF has also warned that cyberattacks against financial institutions could extend beyond individual organisations, potentially disrupting payment systems, undermining public confidence and creating broader financial stability risks.
Consequently, the security challenges facing banks extend beyond protecting customer deposits. A successful attack on a major financial institution or one of its technology providers could affect other organisations that depend on its services.
Although banks experience significant cyber threats, cryptocurrency exchanges face a different category of vulnerabilities because of how digital assets are stored, transferred and managed.
Unlike conventional banking transactions, cryptocurrency transactions are generally irreversible once confirmed on their respective blockchains.
Consequently, when attackers gain access to an exchange’s private keys, wallet infrastructure or withdrawal systems, stolen assets can be transferred across multiple blockchain networks within minutes.
The debate underscores broader questions about resilience in an era of AI-accelerated attacks, state-sponsored groups, and the growing overlap between crypto and traditional finance through stablecoins and tokenized assets.
As investigations continue and Binance works to fully restore confidence, CZ’s remarks highlight an ongoing tension: public crypto losses invite intense scrutiny, while the scale and preparedness of conventional banking systems remain subjects of active discussion among security experts.