About $6.3 billion left Binance wallets in roughly 20 minutes on Oct. 29, in what the source article describes as the largest crypto theft on record and more than four times the size of the Bybit hack in February 2025. Binance said the breach began with an engineer’s computer that was infected during a fake job interview.
Two days after the incident, Binance said it had restored 98% of the assets with its own funds. The exchange resumed withdrawals the following day. The source article uses that sequence to argue that a major exchange hack does not automatically prove self-custody is the safer option for every user.
A visible failure, but not the only kind
The article places Binance alongside a list of high-profile exchange failures and hacks including Mt. Gox, QuadrigaCX, FTX and Bybit, while cautioning against drawing a single, simple lesson from those cases. Its core point is that the phrase “not your keys, not your coins” addresses control of assets, but does not by itself settle the question of security.
According to the article, attacks on large exchanges receive global coverage because of their scale and because an identifiable company issues statements during the crisis. Losses by individual holders are often far less visible, even when the transactions are publicly traceable on-chain, and many victims never report what happened.
Self-custody carries its own attack surface
To make that case, the article lists several recent self-custody loss scenarios. On Jan. 10, 2026, it says, an investor gave a hardware wallet seed phrase to a scammer posing as Trezor support and lost 1,459 BTC and 2.05 million LTC, valued at more than $282 million. In that example, the device itself was not the point of failure.
The article also cites seed leakage through cloud storage or personal backups, signature phishing that lets attackers move tokens after a user signs an off-chain message, and address poisoning, where a near-identical wallet address is planted into a victim’s transaction history. It adds that a single address-poisoning case in January cost $12.25 million, while signature phishing losses in that month alone totaled $6.3 million.
Physical coercion is another category. Citing CertiK, the article says 52 so-called wrench attacks were counted in the first half of 2026 for a combined $124 million, including 33 in France. It also mentions a July 29 incident involving ColdCard users whose wallets were drained because of a randomness flaw in key generation, despite those devices never having been connected to the internet.
The Binance breach also involved signing
The source notes an irony in the Binance case: although it is presented as an exchange hack, the path to the theft also involved signatures. According to the article, Binance’s system was tricked into signing 50 authorizations at once, and one of those approvals was enough to give the attacker control over a wallet that lost $2.2 billion in a single transaction.
That detail is used to blur the usual divide between exchange risk and self-custody risk. In the article’s framing, every custody model depends on trust of some kind, whether in an institution’s governance and solvency or in a user’s own operational security, devices, software and personal judgment.
Why recovery can look very different
A central distinction in the piece is what happens after an attack. In self-custody, the article says, there may be nobody to call and little chance of freezing funds unless they quickly reach an exchange or an issuer able to block transfers. It notes that the funds from the January theft were reportedly converted into Monero almost immediately, making recovery even harder.
With an exchange, users at least have a counterparty, though that only matters if the business remains solvent. The article points to Bybit restoring customer backing in three days, Bitget covering a $388 million September theft with its protection fund, and Binance taking on the full Oct. 29 loss while reporting that 98% had already been restored in its proof of reserves. It also highlights the limits of that model by recalling that Mt. Gox creditors waited about a decade and recovered only around 15% of the bitcoins they once held, while FTX creditors received cash based on November 2022 values rather than the crypto assets themselves.
The next question is custody design, not a slogan
The article’s conclusion is that crypto custody is not a choice between trust and no trust, but between different kinds of trust that should be assessed consciously. It suggests that concentrating all holdings in one place, whether a single exchange or pure self-custody, ignores those trade-offs.
As a practical context point, it says investors should pay attention to whether exchanges segregate customer assets, maintain separate wallets, publish proof of reserves and undergo independent audits. It cites Brazil’s 2025 Central Bank resolutions 519, 520 and 521 as examples of rules aimed at those safeguards. For now, the clearest confirmed development in the Binance case is that the exchange said withdrawals resumed the day after it announced 98% of assets had been restored.
Source: beincrypto.com