Crypto & AI expert Maarten de Borst examines the Binance hack, North Korean cybercrime, crypto security risks, and what MiCA means for the future of digital money.
Eighteen years ago, on October 31, 2008, Satoshi Nakamoto published the white paper that laid the foundation for Bitcoin. The promise was simple: transfer money digitally without relying on banks. Exactly eighteen years later, the crypto world has been shaken by a multibillion-dollar hack at Binance, one of the world’s largest cryptocurrency exchanges.
The attack highlights a fundamental contradiction. It was not the Bitcoin network itself that was compromised, but a trading platform. Moreover, investigators have pointed to North Korean hackers. What does this reveal about the security of crypto assets, the role of intermediaries, and the future of digital money?
In this in-depth interview, Maarten de Borst, management consultant at Numbers and faculty member at Amsterdam Institute of Finance, shares his perspective on the hack, the vulnerabilities of crypto platforms, and the implications for finance professionals.
In this interview:
✔ Why the greatest vulnerability lies not in Bitcoin itself, but in crypto platforms
✔ What the Binance hack reveals about counterparty risk, security, and regulation
✔ How MiCA, stablecoins, and the digital euro are reshaping the future of money
“Regulation makes crypto safer by strengthening the intermediary, precisely the party Bitcoin was designed to make unnecessary.”
– Maarten de Borst, Management Consultant at Numbers
The multibillion-dollar hack that reinforces Bitcoin’s original promise
Maarten, the recent cyberattack on Binance affected billions of dollars in crypto assets. At the same time, Bitcoin celebrates its eighteenth anniversary today, October 31. What does this hack reveal about a technology specifically designed to eliminate financial intermediaries?
“In a way, this hack confirms exactly what Bitcoin warned us about eighteen years ago. The Bitcoin network itself was not hacked, and that has never happened in all those years. The money was stolen from one of the trusted third parties that Satoshi Nakamoto, Bitcoin’s founder, warned against. Based on what we know so far, more than six billion dollars appears to have been stolen in just twenty minutes through one engineer’s compromised laptop. That is precisely the risk Satoshi wanted to eliminate back in 2008.”
“But here’s the uncomfortable truth. Most people do not use crypto the way it was intended. They do not hold their own bitcoin. Instead, they leave it on an exchange. We have essentially reinvented the bank, just in a different form. And with less oversight. What limited the damage was, once again, those very intermediaries. Stablecoin issuers such as Tether and Circle froze billions, while Binance is covering the losses from its own funds. That is not decentralization. That is traditional risk management.”
“So the lesson is not that the technology has failed. The weakest link is often the human element. Anyone working professionally with crypto should therefore look beyond the blockchain itself and focus on who controls the keys. Or, as the old crypto saying goes, ‘not your keys, not your coins.’ And that lesson has never come at such a high price.”
“We have essentially reinvented the bank, just in a different form. And with less oversight.”
North Korea: Cybercrime as a State Strategy
According to blockchain investigators, strong evidence points to the North Korean hacking groups TraderTraitor and Lazarus, which have also been linked to previous major crypto thefts. The regime reportedly uses the proceeds, among other things, to finance its weapons programs. How did North Korea become such a major player in global crypto cybercrime?
“This genuinely worries me. Crypto is still often seen as something far removed from everyday life. Just some internet money for tech geeks. ‘I don’t own crypto, so this doesn’t affect me.’ But it affects everyone. North Korea has been largely cut off from the international financial system by sanctions. The regime turned to crypto as a source of funds it could access online. Billions of dollars are sitting in corporate wallets that can be attacked from anywhere in the world. Hacking in North Korea is not a side hustle for a handful of criminals. It is a highly organized state program employing some of the brightest minds in the world. According to UN estimates, approximately 40 percent of the funding for the country’s weapons of mass destruction comes from cybercrime.”
“Last year, North Korea stole more than two billion dollars, approximately 60 percent of all crypto theft worldwide. These operations involve months of preparation. One common method is to have fake IT professionals apply for jobs at crypto companies. Binance itself said last year that it rejects résumés from North Korean applicants every day. That a single compromised laptop could apparently enable the largest crypto heist in history fits that pattern.”
“Hacking in North Korea is not a side hustle for a handful of criminals. It is a highly organized state program employing some of the brightest minds in the world.”
And what does this multibillion-dollar theft reveal about the vulnerability of the global financial infrastructure?
“That the weak point lies in people and processes, not in the technology. The same applies to banks, by the way. In 2016, North Korea attempted to steal nearly a billion dollars through SWIFT from Bangladesh’s central bank. The difference is that crypto concentrates enormous amounts of money at a relatively small number of institutions operating around the clock, where funds can move around the world in minutes. There is a silver lining, however. Because the blockchain is transparent, investigators were able to track the movement of funds in real time, and approximately three billion dollars was frozen within hours. That rarely happens so quickly in a conventional bank robbery.”
“For finance professionals, the lesson is that cybersecurity is no longer just an IT issue. It is an integrity risk. If you thoroughly screen your customers but fail to screen your own employees and suppliers, you have locked the front door while leaving the back door wide open.”
Explore related AIF programs
1. Cybersecurity for Executives
The Binance hack demonstrates how a single security breach can expose organizations to enormous financial and reputational risks. How can senior leaders recognize cyber threats, challenge security decisions, and strengthen organizational resilience? In the two-day Cybersecurity for Executives program, Tobias Jaeger, Founder & CEO of Falcone International, equips executives with the knowledge and confidence to address cyber risk at the boardroom level, without requiring a technical background.
Explore the Cybersecurity for Executives program >>
2. AI for Finance Professionals
From sophisticated cyberattacks to increasingly automated financial processes, emerging technologies are transforming the risks and opportunities facing finance professionals. How can you turn AI into a practical advantage? In AI for Finance Professionals, Prof. Breanndán Ó Nualláin and Maarten de Borst explore LLMs, prompt engineering, ethical and privacy considerations, and the development of AI agents, helping participants translate AI capabilities into practical applications in finance.
Explore the AI for Finance Professionals program >>
Who really controls your crypto assets?
As you mentioned earlier, one of the fundamental principles of crypto is ‘not your keys, not your coins.’ Yet many investors keep their crypto assets on major trading platforms. Who actually controls those assets?
“The platform, without a doubt. If you hold your bitcoin on an exchange, you do not control the private key. The exchange holds those keys. What you see in the app is an entry in the platform’s records: a claim against the exchange, not bitcoin registered in your name on the blockchain. In that sense, it resembles a bank account, except without a deposit insurance scheme.”
“How secure that claim is depends on the regulatory jurisdiction in which the platform operates. Under the European Markets in Crypto-Assets Regulation (MiCA), a licensed provider must keep customers’ crypto assets legally segregated and separate from its own holdings on the blockchain. It must maintain precise records of which assets belong to each customer and is liable for losses attributable to its own actions. If such a provider goes bankrupt, customer assets are excluded from the bankruptcy estate. FTX in 2022 showed what happens when that separation is missing: customers became ordinary creditors in bankruptcy proceedings.”
“And here’s where it gets complicated. Binance does not have a MiCA license and has not been permitted to offer new services to EU customers since July 1. Binance’s promise to compensate all losses is therefore primarily a commercial commitment rather than a legal obligation under European law. My advice to everyone, whether a private investor or a professional, is to first check the ESMA register to see whether your platform is licensed. That is the minimum level of due diligence.”
What risks do investors face when keeping their crypto assets on a trading platform?
“The first risk is unfolding before our eyes: hacks. An exchange is one enormous target where billions of dollars are concentrated. If something goes wrong, all customers are affected at once, even if they have done nothing wrong. Closely related is liquidity risk. Binance suspended withdrawals after the hack. Your assets may still be there, but you cannot access them when you need them most.”
“The second risk is counterparty risk. You depend on the integrity and solvency of the platform. At FTX in 2022, it became clear that customer funds had quietly been used for the company’s own purposes. When the company collapsed, customers had to line up alongside other creditors. Without strict supervision, customers simply cannot verify what is happening to their assets.”
“The third risk is regulatory risk. An unlicensed platform may suddenly be required to restrict its services in your country. European Binance customers experienced this firsthand over the summer when Binance was forced to leave the EU.”
Does that mean everyone should hold their own crypto assets?
“No. Self-custody shifts the risk to you. If you lose your private key or fall for a phishing message, there is no ‘forgot password’ button, no help desk, and no compensation. The real question isn’t whether to trust someone. It’s who you choose to trust. Choose a licensed provider with segregated custody and demonstrable security measures, and diversify your risk.”
What measures can crypto holders take to reduce their risks?
“Start by choosing the right platform. Check the register maintained by ESMA, the European securities regulator, to see whether your exchange holds a MiCA license. It takes two minutes and is the most important step. Also, don’t put all your eggs in one basket. If you spread your crypto holdings across multiple licensed providers, you will never lose everything because of a single hack or bankruptcy.”
“Only keep on an exchange what you actively trade. For long-term holdings, you may be better off using a hardware wallet, a physical device that stores your private keys offline. Make sure you securely store your backup.”
“Secure your account as carefully as you would secure your bank account. Use two-factor authentication through an authenticator app or a physical security key such as a YubiKey, rather than SMS. Enable an address whitelist so withdrawals can only be made to addresses you have approved.”
“Finally, be especially vigilant right now. Major hacks are always followed by scammers impersonating the affected platform, sending messages such as ‘Your account has been compromised. Log in here.’ A legitimate platform will never ask for your recovery phrase or password. Anyone who does is, by definition, a scammer.”
“The real question isn’t whether to trust someone. It’s who you choose to trust.”
Does stricter regulation really make crypto safer?
The hack also raises questions about the security and oversight of crypto platforms. Can stricter regulation, such as MiCA, genuinely protect users against incidents like these? Or is there a fundamental tension between decentralization, convenience, and security?
“MiCA certainly offers users better protection, but not against everything. The rules require platforms to segregate customer assets from their own holdings, maintain accurate ownership records, and accept liability when losses result from their own actions. In addition, under DORA, the European Digital Operational Resilience Act, licensed providers must take their IT risks just as seriously as banks do. That makes a scenario like FTX, where customer funds disappear without anyone noticing, much harder to repeat.”
“But regulation cannot make hacking impossible. Banks get attacked too. What MiCA does is raise the bar and place responsibility where it belongs: with the platform rather than the customer. And the rules only protect those operating within the regulated system. Binance does not hold a European license, so in this particular incident, European users must rely on the platform’s goodwill rather than legal protections.”
“The tension you describe is real. In the blockchain world, it is often illustrated as a triangle: decentralization, convenience, and security. You can have two at the same time, but never all three. Self-custody is decentralized and can be secure, but it is not particularly user-friendly. It takes effort. An exchange is convenient, but you give up decentralization. MiCA deliberately takes the second approach. The rules focus on intermediaries because fully decentralized services largely fall outside their scope.”
“So, looking back after eighteen years, you could say the irony is complete. Regulation makes crypto safer by strengthening the intermediary, precisely the party Bitcoin was designed to make unnecessary. But is that necessarily a bad thing? For most people, a well-regulated intermediary is simply the more sensible choice. Let’s be clear, though: that is no longer the revolution of 2008. It marks the coming of age of a new financial industry.”
In Focus: 18 Years of Bitcoin – Four Historical Milestones
October 31, 2008 | The birth of an idea
Under the pseudonym Satoshi Nakamoto, the white paper Bitcoin: A Peer-to-Peer Electronic Cash System is published. It describes a digital payment system that allows users to transact directly without relying on banks.
January 3, 2009 | The Bitcoin network goes live
The first block of the Bitcoin blockchain, known as the genesis block, is created. This lays the foundation for a decentralized network in which transactions are recorded and verified.
January 12, 2009 | The first Bitcoin transaction
Satoshi Nakamoto sends 10 bitcoin to programmer Hal Finney. It is the first known Bitcoin transaction between two individuals.
May 22, 2010 | Two pizzas for 10,000 Bitcoin
Programmer Laszlo Hanyecz pays 10,000 bitcoin for two pizzas, marking the first known commercial purchase using Bitcoin. The date is now celebrated as Bitcoin Pizza Day.
From Bitcoin to stablecoins and the digital euro
Eighteen years after Bitcoin’s introduction, the crypto market has changed significantly. Cryptocurrencies have developed into an investment asset class, while banks, companies, and regulators have become increasingly involved. What does this development tell us about the future of money?
“That Bitcoin will not replace the euro, but the technology behind it is changing how we use money. Bitcoin itself has primarily become an investment, a form of digital gold, rather than a means of paying for everyday groceries. The real transformation lies in what the technology has made possible: money that can be transferred globally, around the clock, in seconds, and that can be programmed.”
“We are seeing this happen on three levels simultaneously. Private companies now have approximately 300 billion dollars’ worth of stablecoins in circulation, digital currencies pegged one-to-one to an existing currency. Banks are getting involved as well. A consortium of dozens of European banks, including ING, is working from Amsterdam on its own euro-denominated stablecoin. Earlier this month, they received a license. And the ECB is testing the digital euro. The pilot is scheduled to begin in 2027, with a potential introduction in 2029, provided the necessary legislation is in place.”
“That ultimately makes this a geopolitical issue as well. Almost all stablecoins are currently pegged to the US dollar. If the future of money is digital, Europe must ensure that the euro has a place in that future. Otherwise, we may end up making digital payments in dollars. At that point, it is no longer just about technology, but about monetary sovereignty.”
What knowledge do CFOs, controllers, accountants, and compliance professionals need to properly assess the opportunities and risks?
“They do not need to become programmers, but they do need to know which questions to ask. This hack illustrates exactly what those questions are. Who controls the keys? Is the provider licensed? Are customer assets segregated from the provider’s own holdings? If you cannot ask those questions, you cannot properly assess a crypto position or a crypto-related counterparty, whether it concerns your own treasury operations, a client, or a potential acquisition target.”
“The knowledge required also varies by role. CFOs need to understand the strategic implications of stablecoins, tokenization, and the digital euro for payments, treasury, and financing. Controllers and accountants need to understand how to recognize and value crypto assets. Under IFRS, these are generally not treated as cash or financial instruments, but as intangible assets or inventory. They also need to know how to verify that the assets actually exist. For compliance professionals, the key issues include MiCA, sanctions screening, the travel rule for crypto transfers, and the new European reporting requirements under DAC8. That also requires a basic understanding of blockchain analytics, because the movement of funds is publicly visible if you know how to interpret the data.”
“Perhaps the most important thing is the mindset. Many finance professionals still think crypto is a niche that has nothing to do with them. But exposure can enter through the back door: through customers, suppliers, payment partners, and investments. Those who take the time to understand it now will be able to contribute when important decisions are made. Those who wait risk being left out of the decision-making process.”
“For finance professionals, the lesson is that cybersecurity is no longer just an IT issue. It is an integrity risk.”
Read also: Cybersecurity moves into the boardroom: 5 takeaways
Meet the expert
Maarten de Borst is a management consultant at Numbers, a boutique advisory firm specializing in the practical application of technology within the financial sector and government. He previously spent seven years in various finance roles at ING, ABN AMRO, and Moneyou, working in Frankfurt and Amsterdam. Recognizing the need for greater practical applicability of technology within organizations, he went on to found Numbers.
In addition to his advisory work, Maarten is the author of three business books and an advisor on financial crime to the Dutch National Police. He is also an active speaker on the intersection of technology and finance. In 2020, he was recognized by the Dutch Financial Times (Het Financieele Dagblad) as one of the Netherlands’ most promising young talents. He graduated cum laude from Erasmus University Rotterdam with a Master’s degree in Financial Economics.
Discover Maarten de Borst’s expertise and programs.
Explore related AIF programs
1. Cybersecurity for Executives
The Binance hack demonstrates how a single security breach can expose organizations to enormous financial and reputational risks. How can senior leaders recognize cyber threats, challenge security decisions, and strengthen organizational resilience? In the two-day Cybersecurity for Executives program, Tobias Jaeger, Founder & CEO of Falcone International, equips executives with the knowledge and confidence to address cyber risk at the boardroom level, without requiring a technical background.
Explore the Cybersecurity for Executives program >>
2. AI for Finance Professionals
From sophisticated cyberattacks to increasingly automated financial processes, emerging technologies are transforming the risks and opportunities facing finance professionals. How can you turn AI into a practical advantage? In AI for Finance Professionals, Prof. Breanndán Ó Nualláin and Maarten de Borst explore LLMs, prompt engineering, ethical and privacy considerations, and the development of AI agents, helping participants translate AI capabilities into practical applications in finance.
Explore the AI for Finance Professionals program >>