The Binance hack proves custody is a choice, not a default

Is your crypto safe because the exchange holding it is the biggest in the world? The past week suggests that size is not a security policy.

Here is what happened. Binance disclosed a hack on October 29, and the FBI said over the weekend that North Korea was responsible, pointing to a group it calls TraderTraitor. According to The Verge, the bureau described more than $6 billion in stolen virtual assets, mostly being converted into Ether ahead of further laundering, while offering few other details or evidence. Binance froze withdrawals, then began reopening them, and says it has covered 95% of the losses from its own reserves. Binance also said it would publish an updated proof of reserves on Monday.

That is the headline. The argument is more interesting.

Exchange risk is now state-level risk

For years, the standard worry about leaving coins on an exchange was the exchange itself: bad management, thin reserves, a collapse. This episode adds a different adversary. As taz reports, TraderTraitor is linked to the Lazarus network, which is tied to North Korean intelligence, and the same group is blamed for the $1.5 billion Bybit theft in February 2025. A country under heavy sanctions, with a cyber unit that a 2020 US Army report put at around 6,000 people, is not a threat a retail saver can reason with.

Notice also how the attack apparently began. Binance has said it may have come through an IT employee's laptop, and that there is so far no evidence that private keys were stolen. In our view, that detail matters more than the dollar figure. It suggests the weak point was not exotic cryptography but an ordinary workstation. Any custodian, however big, has laptops.

"Users were made whole" is the least reassuring sentence

Credit where it is due: Binance's promise that it, not its users, will bear the loss is the best outcome customers could have hoped for. Reporting indicates it set aside more than $6.34 billion to cover the losses. Few firms could do that.

But look at what that outcome depended on. Not on anything the user controlled, but on the exchange's balance sheet and its willingness to use it. A balance on an exchange is, in our view, a claim on a company, not coins in your hands, and this hack is a live demonstration. The claim held up because the company was rich and chose to pay. A smaller exchange hit by the same group might not have that option, and we would not assume the same ending.

There is also a cost that never shows up in the compensation announcement. Withdrawals were frozen for days, and markets reacted: Bitcoin fell almost 5%, Ether nearly 6% and BNB almost 10%, according to the reports. Being made whole in dollars does not give you back the ability to act at the moment you most want to.

Treat custody as a decision, and size it to your life

We are not telling anyone to flee exchanges. They are convenient, and for active trading they are practically necessary. What we do think is that "default" is the wrong way to arrive at a custody arrangement. A few questions are worth answering deliberately:

• What am I trading, and what am I holding? Coins you plan to hold for years do not need to sit where a frozen withdrawal button can strand them.
• Can I live with a multi-day freeze? If not, don't keep money you may need on one platform.
• Do I use the verification tools offered? Proof-of-reserves checks, if Binance's holds up, are useful but only a snapshot. We would treat them as a signal, not a guarantee.
• Am I concentrated? Spreading across custodians, or moving part to self-custody, reduces the damage from any single failure. Self-custody has its own risks, mainly your own mistakes, so it is a trade-off, not a cure.

None of this is personalized advice, and rules on exchange protections differ by country, so check what applies where you live.

Our verdict

The FBI attribution is, for now, an official claim; North Korea has long denied such accusations, and the public evidence is thin. Still, even if details shift, the lesson doesn't. The biggest exchange in the world was hit for billions, with most of the funds moved within about 20 minutes according to TRM Labs, and customers were spared mostly because the company could afford it. That is luck of balance sheet, not design.

Our recommendation is simple: decide where each part of your crypto lives, on purpose, and write down why. If the honest answer is "wherever I happened to buy it," this week was your reminder.