Who Polices the Blockchain? The Binance Heist and the New Gatekeepers

On 29 October, the largest heist in history took less than half an hour to unfold. The loss by Binance – the world’s largest crypto exchange – of US$6.3 billion became instant front-page news and led TV bulletins. Alongside the media headlines and breathless commentary and hot takes, the loss highlights three developments that are not new but are increasingly consequential for international financial security. First is scale. The digitalisation of finance has transformed the speed, reach and potential scale of financial crime. Just imagine how many banks would need to be raided to gather just a fraction of the loot secured from Binance. Second, borders. Criminals have long exploited the gaps between jurisdictions and the constraints placed on law enforcement by those boundaries. In a world dominated by digital financial services, as things stand, borders neuter governments’ abilities to respond. And third – most strikingly – control. Governments retain legal authority over financial activity, but the practical capability to identify, trace and interrupt illicit financial flows increasingly rests with privately held technology and financial sector companies.

So, in this day and age, who actually polices the blockchain on which the crypto industry and those that attack it rely? And are governments and international institutions, including the Financial Action Task Force (FATF), the global anti-financial crime watchdog, adapting sufficiently quickly to this very obvious redistribution of operational capability, or are they stuck in an analogue frame of mind?

The Biggest Bank Robbery That Never Happened

At the time of writing, it is still not entirely clear how Binance’s defences were so comprehensively breached. What is clear is that however long it took to plan and however technically complex the design of the operation, this heist was conducted remotely from across the globe, with no need to pull on a balaclava, threaten staff with a shotgun, and speed through the streets in a getaway car to safety. In essence, the crime was entirely risk-free; and with ever more financial and economic activity carried out and stored online, the size of the prize for those with the necessary patience and skill is immense. And when the ‘criminal’ is a state with motivation, purpose and years of experience to draw on, the result can be spectacular.

None of this is of course new. North Korea’s crypto hackers have nearly a decade of experience of attacking crypto infrastructure to support the funding of the country’s WMD programme in the face of heavy international sanctions, a capability that, despite global efforts, they can clearly deploy at will.

Borders are a Criminal’s Best Friend

Crossing county lines or absconding to a third country have long been a preferred method by which criminals seek to escape to safety to enjoy their loot. Differences in legal systems, enforcement capabilities and regulatory standards present money launderers, organised crime groups and sanctions evaders with welcome jurisdictional arbitrage. Digital financial infrastructure has intensified this problem by enabling value to move across multiple jurisdictions at extraordinary speed, often visible on the blockchain to those helpless law enforcement agencies in pursuit as they complete paperwork and bureaucracy that seems almost purpose made to confound their mission. In short, borders have always been a criminal’s best friend – digital finance has exposed the utility of such a valuable accomplice.

A Post-Government Era of Financial Security?

But it would seem all is not lost. Perhaps the most striking feature of the Binance saga is a notable paradox. Despite the libertarian narrative surrounding the ‘cryptoverse’ – and indeed the founding principle of decentralised peer-to-peer exchange on which Satoshi Nakamoto based the creation of Bitcoin – this world is increasingly beholden to powerful private institutions.

Consider the way in which stablecoin issuers, other exchanges, and blockchain intelligence providers have mobilised to confront the heist. Tether and Circle, issuers of the two most popular global stablecoins, used their central market position to freeze US$2.4 billion, preventing the hackers from spiriting those funds away. Analytics firms like Chainalysis, Crystal Intelligence and Elliptic provided near-real-time tracking, commentary and advice to those seeking to impede the movement of funds beyond the reach of those in pursuit. This is not the place to get technical, but suffice to say, what was rapidly achieved in response to what is undoubtedly a global security threat given North Korea’s motivation for conducting such raids was remarkable. Even more striking is that the response to this state-based global crime has been almost entirely led (with an apparent assist from the US Secret Service) by a handful of private sector actors.

But the emergence of a small number of highly dominant, private sector gatekeepers raises yet more questions about the changing relationship between governments, technology companies and the exercise of financial authority. And herein lies the crux of the expensive lessons emerging from the frantic activity that followed the 29 October hack. The growth of a combination of digitised finance and privately-operated financial services presents an unavoidable tension between legal authority and operational capability when it comes to ensuring the integrity of this new financial system. Who has the necessary capabilities? Who has the authority to act? And who is ultimately accountable?

In this case, early indications suggest that collaboration and speed of (correct) decision-making have been impressive. But what would have happened if stablecoin issuers Tether and Circle had hesitated, awaiting legal confirmation to act? What does the ability of these companies to arbitrarily freeze assets say about the government controls under which they operate? This time they appear to have acted for the greater good; next time the frozen assets could belong to political opponents of an incumbent authoritarian leadership.

Thus, the most important lesson of the past week is that while we may not be ‘post-government’, we are perhaps entering one in which governments cannot exercise meaningful financial control without the cooperation of companies whose international reach and technical capabilities exceed their own. Thus, although governments may retain the authority to decide when financial activity should stop, they appear to increasingly depend on private companies to make it stop.

Is the FATF Keeping Up?

So, what does this all mean for the international institutions established to coordinate financial regulation and enforcement? This job primarily falls to the FATF, established in 1989 to develop international standards to protect the integrity of the financial system that governments are required to implement through national laws, regulation, supervision and enforcement, which it has spent nearly 40 years adapting to the constantly changing financial landscape it oversees.

Ironically, the Binance attack unfolded just as the FATF was concluding its latest plenary in Paris, at which it announced plans to launch a targeted review of jurisdictions with materially important cryptoasset activities, noting that ‘criminal networks continue to abuse virtual assets, exploiting both their cross-border nature and implementation gaps’ and that jurisdictions should ‘urgently address remaining implementation gaps and deficiencies’ in their defences.

The FATF has rightly acknowledged that securing the integrity of the financial system relies not only on the effectiveness of governments translating agreed standards into meaningful national action, but also the ability of the private sector to implement the standards it promotes. But are international standard-setting and national implementation keeping pace with the clearly changing distribution of capability? In the face of the biggest financial crime ever perpetrated on its watch, the architecture of financial intelligence units and other government paraphernalia championed by and represented at the FATF plenary has been side-lined in favour of private sector blockchain analytics firms and stablecoin issuers.

Has the FATF become irrelevant? Not yet, but this incident must surely trigger a meaningful rethink in how the integrity of the financial system is secured, and whether its standards are bringing the right organisations into the spotlight.

Freezing Money is Not the Same as Recovering It

So, three cheers for the private sector and its ability to police the blockchain. But there is an important caveat to observe. Tether, Circle and their fellow travellers have frozen assets – confiscating and recovering assets is another matter that certainly requires the involvement of governments and their laws. Furthermore, now it is many billions of dollars better off, North Korea will undoubtedly convert these funds into fiat funds – or other forms of value – that allow them to be used for Pyongyang’s ultimate mission. Opportunities to disrupt North Korean ambition remain and, to capitalise on these, the role of governments and the traditional private sector is only just beginning.

The true measure of the success of the response to this case will not be how much stolen cryptocurrency can be traced or frozen, but how much illicit value can ultimately be denied to those seeking to use it.

Who Should Police the Future Financial System?

For some time, the self-appointed guardians of the integrity of the financial system have faced a dawning reality. What if all the sound and fury they have spent years mobilising is increasingly misdirected? What if the genuine threats to the integrity of the financial system are not covered by their carefully negotiated recommendations and standards?

For the policymakers who sit at the top table, the Binance saga underlines three urgent actions.

First, there must be clarity on responsibilities and accountability. There must be clear expectations concerning the circumstances in which private companies should unilaterally freeze assets, share information or intervene in financial transactions, including the imposition of appropriate safeguards.

Second, there must be a defined connection between private capabilities and public authorities. Law enforcement, regulators and prosecutors must be able to work at a speed commensurate with digital financial activity, while preserving legal protections and due process. This time, it appears the FBI and US Secret Service were in the loop, but the extent to which private sector actors appear to have acted independently suggests there is a meaningful gap to address.

And lastly, a radical re-examination of the model on which the response to financial crime is predicated is needed. It is no longer possible to ignore the sense that decades of investment in developing and implementing standards and recommendations has not kept up with the nature and scale of the illicit finance threat.

The challenge for governments is not to replicate the capabilities of private technology companies, but to ensure that those capabilities serve public security objectives within a framework of democratic accountability and the rule of law.

Notwithstanding the enormity of the Binance heist, and the implications of a rogue nuclear power gaining access to billions of dollars to further boost its WMD investment, the private sector response was remarkable and unprecedented. The art of the possible is plain to see.

The fundamental question is therefore, when considering the future of finance, who has the capability, authority and responsibility to police this new world. Blockchain has transformed how money moves. The Binance incident suggests that we must now reconsider who has the power to decide when it stops.

© RUSI, 2026.

The views expressed in this Commentary are the author's, and do not represent those of RUSI or any other institution.

For terms of use, see Website Terms and Conditions of Use.

Have an idea for a Commentary you'd like to write for us? Send a short pitch to commentaries@rusi.org and we'll get back to you if it fits into our research interests. View full guidelines for contributors.