Crypto Exchange Hacks and What You Shouldn't Conclude From Them

On October 29, in about twenty minutes, $6.3 billion left Binance’s wallets. The largest crypto theft in history, more than four times the Bybit hack of February 2025.

The entry point, according to the exchange itself, was an engineer’s computer, infected after a fake job interview.

Two days later, Binance announced it had restored 98% of the assets with its own funds; the next day, it resumed withdrawals.

Hold on to that last fact. It’s the most important one, and the least talked about.

To a Man with a Hammer, Every Problem Looks Like a Nail

Mt. Gox, 2014. QuadrigaCX, 2019. FTX, 2022. Bybit, 2025. Binance, 2026, to name just the most notorious. Different problems, always the same answer: self-custody, because, after all, not your keys, not your coins.

The premise is technically true. If you don’t hold the private key, you don’t control the asset: you have a claim against whoever does.

The conclusion usually drawn from it isn’t that self-custody is, necessarily, safer.

The Graveyard of the Defeated is Silent, Unless the Defeated is Very Big

When an exchange is attacked, the whole world sees it. There are billions at stake, an official statement, and international coverage.

When an individual loses everything, almost nobody finds out. Even if the loss is on-chain, strictly public, who among the general public follows blockchain investigations?! The general public follows the press.

Many of these victims don’t even file a police report, out of shame or disbelief.

On this side, the investigators’ side, the scene is familiar: the victim shows up with transaction hashes and the hope that someone will “freeze the bitcoins.” 

And, unless the planets align (a victim who reports quickly and well, a qualified public official, funds that end up at an exchange or in freezable tokens), the outcome is dreadful.

Attacks on big exchanges aren’t the most frequent. They’re just the ones everyone sees.

A special Selection from the Self-custody Risk Menu

Handing over the seed. On January 10, 2026, an investor read out his hardware wallet’s seed to a scammer posing as Trezor support. He lost 1,459 BTC and 2.05 million LTC, more than $282 million. The device worked perfectly. Its owner didn’t.

Seed compromise. A photo on your phone, a note in the cloud, an email to yourself. Nobody asked for the words: they simply leaked.

Signature phishing. You sign an off-chain message that authorizes third parties to move your tokens, and they leave whenever the attacker wants. Think of a blank signed check, forgotten in a stranger’s drawer. In January 2026 alone, that came to $6.3 million. 

The irony: the Binance hack also went through signatures. The exchange’s system was tricked into signing 50 authorizations at once, and one was enough to hand the attacker a wallet that lost $2.2 billion in a single transaction. 

Wrench attack. The name comes from the wrench. No cryptography withstands a physical threat against you or your family. In the first half of 2026, CertiK counted 52 of them, totaling $124 million; 33 in France alone. 

Address poisoning. The scammer plants in your history an address almost identical to a legitimate one. On your next transfer, you copy the wrong one. A single case, in January, cost $12.25 million. 

Device failure. On July 29, ColdCard users who had never connected their device to the internet were drained because of a randomness flaw in key generation. More than a thousand bitcoins. I analyzed the case in “Not your keys, not your coins — but do you know how your keys are generated?“.

Notice: in each case, the victim trusted something. The support line, the cloud, the website, their own discretion, the transaction history, the firmware. And, in every case, they trusted their own ability.

Self-custody or Exchange? The False Dilemma

Every form of custody carries risk. Whoever leaves assets on an exchange trusts its governance and solvency. Whoever self-custodies trusts themselves, the device, the software, and whoever knows they own bitcoin. The problem is acknowledging the first and ignoring the second.

There’s no option without trust. There’s conscious trust and ignored trust. And the most expensive risk is the one you don’t see.

Nobody should keep all their wealth under the mattress, nor all of it in a single bank.

With crypto assets, the logic should be the same: part on a solid exchange (or three of them), part in well-done self-custody, part in ETFs — 30%, 40% and 30%, for example. 

The split depends on your knowledge, your profile, and your goals. That responsibility can’t be delegated. Sorry for the bad news, but better now than later.

The Day After Tomorrow

Responsibility reduces risks, but doesn’t eliminate them. So don’t just ask “which option is safest for me?” but also “what would happen to me after an attack?”

In self-custody, there’s no one to call. January’s $282 million started being converted into Monero right away (BTC, BTC, LTC). Freezes happen when the money touches a stablecoin issuer or an exchange. Full recovery is the exception.

On an exchange, there’s a counterparty. Bybit restored its customers’ backing in three days. Bitget covered the $388 million taken in September with its protection fund. 

Binance took on 100% of the loss and has already restored 98%, verifiable in its proof of reserves.

A counterparty, of course, is only worth something if it’s solvent. And it doesn’t always give back exactly what you had.

Mt. Gox creditors waited a decade and got back only about 15% of the bitcoins they “had.” Thanks to the appreciation over that period, though, that fraction was worth many times their entire 2014 balance. 

FTX creditors got cash, not the crypto assets in their balances: about 120% of their value at the collapse, in November 2022, with bitcoin near $16,000. More than they were worth at the time; far less than they’d be worth today. 

Hence the importance, in Brazil, of Central Bank (BCB) Resolutions 519, 520 and 521, of 2025. 

For investors, what matters most isn’t that the exchange answers to the Central Bank, but the requirements it’s subject to: customer assets segregated from the company’s, in separate wallets, with proof of reserves and independent audits, and barred from use in the company’s own operations 

The Bottom Line

Not your keys, not your coins is a maxim about control, not about security.

Whoever pulls all their wealth off exchanges doesn’t stop trusting. They just shift that trust, almost always to themselves, without ever asking whether they deserve it.

Custody isn’t choosing whom not to trust. It’s choosing, consciously, whom to trust, what