South Korea's Lee calls for a cybersecurity czar after the $6.3bn Binance theft

South Korea's president, Lee Jae-myung, has asked his government to consider creating a powerful "cybersecurity czar" to coordinate the country's defences against hackers. Speaking at a cabinet meeting on 3 November, he pointed to the recent theft of about $6.3bn from Binance, the world's largest cryptocurrency exchange.

The proposal is a response to what may be the largest crypto theft on record, and to a series of breaches at Korean financial firms.

What Lee asked for

Lee told ministers that artificial intelligence is making hacking more sophisticated and more routine, and that a security system built on inspections and responses after the fact has reached its limits. He said South Korea needs to spot and share signs of attack early and block threats before they land.

He asked officials to look seriously at setting up a strong central body to oversee security work that is now spread across many government offices, and suggested a joint structure covering both the public and private sectors. He singled out finance, energy and communications networks as critical systems that need better protection.

Lee did not name Binance at the meeting. He referred to a recent attack on the world's biggest crypto exchange, believed to be the work of a hacking group, that caused enormous losses; Korean media reported that he meant the Binance theft. What the new body would look like, and which powers it would take over, has not yet been decided.

The Binance theft

The attack on Binance took place on or about 29 October. Binance said around $6.3bn in digital assets was taken, and blockchain analysts described it as the biggest crypto heist on record, roughly four times the $1.5bn stolen from the Bybit exchange in 2025.

On 31 October the FBI said North Korea was responsible, attributing the theft to a group known as TraderTraitor, which investigators link to the Lazarus Group. Chainalysis and TRM Labs had earlier pointed to a North Korean unit. North Korea has denied involvement.

Binance first suspected that one engineer's laptop had been compromised. Its co-chief executive, Richard Teng, later said the investigation had found more points of entry and that the attackers used tools designed to destroy traces as they went. Binance says it set aside more than $6.3bn of its own funds to cover customers, has bought back most of the stolen assets and has reopened withdrawals in phases. Investors withdrew a net $3.6bn in the first days after it reopened.

Pressure on Korean exchanges and firms

The Binance theft is not South Korea's only concern. Several Korean financial companies have been breached recently, including Mirae Asset Global Investments, the exchange Bithumb and Daishin Securities, and some incidents exposed customer data.

The National Intelligence Service has begun emergency security checks at more than 2,100 public bodies, and the Financial Services Commission has called in staff from five domestic exchanges to review their readiness. Korean rules already require exchanges to keep at least 80% of customer crypto offline. The Binance funds were taken from online "hot" wallets.

Why Europe should pay attention

Europe faces the same pressures. EU crypto firms now operate under the MiCA regulation, and financial companies must meet the Digital Operational Resilience Act's rules on cyber risk. The Binance case shows how quickly one breach at a large platform can move markets and drain deposits.

For European crypto and fintech start-ups, the practical lessons are familiar but urgent: limit hot-wallet exposure, protect engineers' devices, and plan for attackers using AI. South Korea's next step is to define the czar's powers; how far it centralises cyber defence will be watched by regulators elsewhere.