Key Takeaways
- • The article reports a USD 6.3 billion Binance breach in October 2026, following the USD 1.5 billion Bybit hack in February 2025 that the FBI attributed to North Korea's TraderTraitor operation.
- • South Korea requires exchanges to hold at least 80% of customer cryptocurrency in cold wallets; September 2026 figures showed Upbit at 99.17% offline, Bithumb at 94.76%, and Coinone at 85%.
- • Binance said on November 2 that it had replenished approximately 95% of affected assets using corporate funds, after completing a reserve snapshot covering ten cryptocurrencies.
- • Reuters valued Binance's Secure Asset Fund for Users (SAFU) at approximately USD 1 billion in Bitcoin during 2026, but the article notes that insurance exclusions, deductibles, and payout limits can leave losses uninsured.
- • The article concludes that no single control is sufficient and advises investors to evaluate withdrawal controls, custody disclosures, and security histories before leaving balances on an exchange.
Summary
Cryptocurrency exchanges face growing cybersecurity threats as attackers target digital wallets, private keys, and transaction systems. The article cites the USD 1.5 billion Bybit hack of February 2025 as evidence of the scale of these risks, and reports a USD 6.3 billion Binance breach in October 2026 that intensified concerns about investor protection. The Binance figure is presented as reported in the article and has not been independently verified in this summary.
Cold storage is described as one of the strongest defenses because private keys remain disconnected from internet-facing systems. South Korea requires exchanges to keep at least 80% of customer cryptocurrency in cold wallets, and September 2026 figures showed Upbit holding 99.17% offline, Bithumb 94.76%, and Coinone 85%. The article cautions that offline storage cannot eliminate risks from compromised transaction approvals. Multi-signature technology, which requires several independent approvals before a transfer can proceed, is paired with multi-party computation, hardware security modules, withdrawal limits, and address whitelisting. The article notes that the Bybit attack showed sophisticated attackers can still manipulate transaction-signing workflows, and attributes approximately USD 1.5 billion in stolen assets to North Korea's TraderTraitor operation, according to the FBI.
Proof-of-reserves systems allow customers to check whether exchanges hold assets matching reported balances. The article says Binance uses Merkle trees and zero-knowledge proofs to enable verification without exposing account information. Following its October breach, Binance reported completing a reserve snapshot covering ten cryptocurrencies, including Bitcoin, Ethereum, and stablecoins, and said on November 2 that it had replenished roughly 95% of affected assets with corporate funds. The article cautions that reserve snapshots alone cannot establish solvency without examining liabilities and off-chain obligations.
Emergency funds and insurance are presented as backstops when preventive controls fail. Binance maintains SAFU, which Reuters valued at approximately USD 1 billion in Bitcoin during 2026. Specialized crypto policies may cover private-key theft or custody breaches, but exclusions, deductibles, and payout limits can leave losses uninsured, so the article argues exchanges need liquid corporate reserves and documented compensation procedures. On monitoring, blockchain analytics tools flag unusual withdrawals and suspicious addresses, while automated alerts, transaction delays, and emergency withdrawal suspensions can limit damage during an active intrusion. After the Bybit theft, the FBI urged exchanges, blockchain services, and infrastructure providers to block transactions involving identified attacker-controlled addresses.
The article's conclusion is that large-scale crypto security depends on overlapping defenses, including cold storage, independent transaction approvals, transparent reserves, and contingency funding. It advises investors to review withdrawal controls, custody disclosures, and security histories before trusting exchanges with balances.
Cold storage is described as one of the strongest defenses because private keys remain disconnected from internet-facing systems. South Korea requires exchanges to keep at least 80% of customer cryptocurrency in cold wallets, and September 2026 figures showed Upbit holding 99.17% offline, Bithumb 94.76%, and Coinone 85%. The article cautions that offline storage cannot eliminate risks from compromised transaction approvals. Multi-signature technology, which requires several independent approvals before a transfer can proceed, is paired with multi-party computation, hardware security modules, withdrawal limits, and address whitelisting. The article notes that the Bybit attack showed sophisticated attackers can still manipulate transaction-signing workflows, and attributes approximately USD 1.5 billion in stolen assets to North Korea's TraderTraitor operation, according to the FBI.
Proof-of-reserves systems allow customers to check whether exchanges hold assets matching reported balances. The article says Binance uses Merkle trees and zero-knowledge proofs to enable verification without exposing account information. Following its October breach, Binance reported completing a reserve snapshot covering ten cryptocurrencies, including Bitcoin, Ethereum, and stablecoins, and said on November 2 that it had replenished roughly 95% of affected assets with corporate funds. The article cautions that reserve snapshots alone cannot establish solvency without examining liabilities and off-chain obligations.
Emergency funds and insurance are presented as backstops when preventive controls fail. Binance maintains SAFU, which Reuters valued at approximately USD 1 billion in Bitcoin during 2026. Specialized crypto policies may cover private-key theft or custody breaches, but exclusions, deductibles, and payout limits can leave losses uninsured, so the article argues exchanges need liquid corporate reserves and documented compensation procedures. On monitoring, blockchain analytics tools flag unusual withdrawals and suspicious addresses, while automated alerts, transaction delays, and emergency withdrawal suspensions can limit damage during an active intrusion. After the Bybit theft, the FBI urged exchanges, blockchain services, and infrastructure providers to block transactions involving identified attacker-controlled addresses.
The article's conclusion is that large-scale crypto security depends on overlapping defenses, including cold storage, independent transaction approvals, transparent reserves, and contingency funding. It advises investors to review withdrawal controls, custody disclosures, and security histories before trusting exchanges with balances.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.