Story
Nov 1, 2026
Binance’s Record Heist Puts Crypto’s Promise of Protection to the Test
Binance and some security specialists argue that swift freezes and corporate backing can shield customers from losses, while critics say the record theft shows crypto still lacks the protections users expect when security fails.
The alarm began Thursday, when Binance suffered what has been described as the largest cryptocurrency theft on record: roughly $6.3 billion in client assets was affected. On the same day, Polymarket’s international platform halted trading after a separate third-party breach drained at least $2.7 million from wallets—an uncomfortable reminder that the vulnerability extends beyond one exchange.1
Investigators suspect the Binance operation was tied to TraderTraitor, a group linked to North Korea’s Lazarus network. Binance said the attackers gained entry by compromising an engineer’s laptop, alongside other unidentified breach points. The operation moved with startling speed: Chainalysis researchers said the funds were taken in as little as 20 minutes, while the attackers appeared to automate transactions, laundering and evidence-destruction as they went.2
Binance froze withdrawals and deposits in the immediate aftermath, later restoring deposits. It said blockchain partners had frozen at least $3 billion, while co-CEO Richard Teng called it “a complex attack.”2 Former Binance chief Changpeng Zhao then publicly urged Elon Musk to stop mocking the company, writing: “Bad time to troll. Please stop.”3
The incident has sharpened a divide over what users should do next. Tyler Moore, a cybersecurity professor at the University of Tulsa, warned that leaving substantial funds on an exchange is “extremely dangerous,” arguing there are “no built-in protections” when hacks occur.1 Unlike bank deposits, exchange-held crypto has no FDIC-style coverage.
Others see a more practical calculation. Blockaid CEO Ido Ben-Natan said Binance’s commitment to reimburse users meant “no users will lose any money,” and argued exchanges must harden their defenses rather than drive users toward self-custody wallets that cannot reimburse theft victims.1
Regulators, meanwhile, point to the offshore setting. CFTC Chair Michael Selig said such platforms do not have “the same sorts of safeguards” as U.S. financial markets.1 Yet experts caution that rules alone may not stop a compromised laptop—or the next automated raid.