Trail leads to North Korea: Mirko Ross on the biggest crypto heist yet at Binance
The world’s largest cryptocurrency exchange has been hacked. More than 6 billion dollars are gone, and the trail leads to North Korea. On heute journal update on 30 October 2026, Mirko Ross, cybersecurity expert and CEO of asvin, explains what lies behind the attack and how investors can protect themselves.
This is a robbery on a new scale: attackers have stolen more than 6 billion dollars in cryptocurrency from Binance. It is not the first time the exchange has been targeted. In an earlier case, a Binance employee’s laptop gave hackers their way in. This time the company is playing it down and says users’ assets are completely safe.
The attack did not come as a complete surprise to Mirko Ross:
“I wasn’t entirely surprised, because there have been attacks like this in cybersecurity before. But the sheer scale and the amount of cryptocurrency stolen here really knocked me off my feet.”
20 lorries full of gold
Binance has pledged to cover the losses. Mirko Ross uses a comparison to show how big the sum is: “If we converted the sum into gold and had the supervillain Goldfinger from James Bond, he would have needed 20 lorries for this heist. With cryptocurrency, of course, it all happens much faster.”
It is still unclear whether investors will get all their money back.
“What we know is that Binance can cover part of the stolen currency from its own funds, but not all of it. That leaves around 2 billion dollars that Binance wants to cover. It remains to be seen whether they will manage it.”
North Korean hackers on a new scale
According to the US analytics firm TRN, the attack is linked to a North Korean hacker group. Ross thinks this is plausible: “We have to wait for the final analyses. But North Korea has built up a state-backed hacker group that has stolen cryptocurrency again and again in the past. Most recently, we know of 1.5 billion. This new hack, at over 6 billion, is a completely different dimension. There is a lot to suggest that parts of the stolen currency have indeed flowed into crypto accounts attributed to North Korea.”
Hot wallet or cold wallet
Hacker attacks are getting harder and harder to fend off. So how can investors protect themselves? Mirko Ross explains the difference between two types of crypto wallets: “Experienced crypto investors know the problem. The attacks target hot wallets. These are crypto wallets connected directly to the internet and used for fast trading. The experienced investor uses a cold wallet. You can disconnect it from the internet, and as long as it is disconnected, it is safe. But you can’t trade quickly with it.”
The full interview with Mirko Ross from heute journal update on 30 October 2026 is available in the ZDF Mediathek (Starting at 9:40 Minute):
https://www.zdf.de/play/magazine/heute-journal-update-104/heute-journal-update-vom-30-oktober-2026-100
Konrad Buck
Head of Press and Media Relations
Background & Expert Access for Media
- Product & technology insights – technical context, solution architecture, and real-world use cases for professional and trade media
- Expert commentary & background talks – our CEO is available as an expert source on current cybersecurity developments, threat landscapes, and the impact of AI on security and regulation
I speak openly, fact-based, and without PR spin. I am a former IT journalist with decades of experience in the IT and cybersecurity space, familiar with the highs and lows of the industry. Off-the-record discussions are possible upon request.
