Crypto Exchange Hacks And What You Shouldn't Conclude From Them

What Happened

On October 29, in about twenty minutes, $6.3 billion left Binance’s wallets. The largest crypto theft in history, more than four times the Bybit hack of February 2025.

Two days later, Binance announced it had restored 98% of the assets with its own funds; the next day, it resumed withdrawals.

When an individual loses everything, almost nobody finds out. Even if the loss is on-chain, strictly public, who among the general public follows blockchain investigations?! The general public follows the press.

On this side, the investigators’ side, the scene is familiar: the victim shows up with transaction hashes and the hope that someone will “freeze the bitcoins.”

Handing over the seed. On January 10, 2026, an investor read out his hardware wallet’s seed to a scammer posing as Trezor support. He lost 1,459 BTC and 2.05 million LTC, more than $282 million. The device worked perfectly. Its owner didn’t.

The irony: the Binance hack also went through signatures. The exchange’s system was tricked into signing 50 authorizations at once, and one was enough to hand0x28c6c06298d514db089934071355e5743bf21d60" rel="nofollow noopener noreferrer" target="_blank"> the attacker a wallet that lost $2.2 billion in a single transaction.

Market Context

The entry point, according to the exchange itself, was an engineer’s computer, infected after a fake job interview.

Hold on to that last fact. It’s the most important one, and the least talked about.

Why It Matters

A special Selection from the Self-custody Risk Menu

Details

To a Man with a Hammer, Every Problem Looks Like a Nail

Mt. Gox, 2014. QuadrigaCX, 2019. FTX, 2022. Bybit, 2025. Binance, 2026, to name just the most notorious. Different problems, always the same answer: self-custody, because, after all, not your keys, not your coins.

The premise is technically true. If you don’t hold the private key, you don’t control the asset: you have a claim against whoever does.

The conclusion usually drawn from it isn’t that self-custody is, necessarily, safer.

The Graveyard of the Defeated is Silent, Unless the Defeated is Very Big

When an exchange is attacked, the whole world sees it. There are billions at stake, an official statement, and international coverage.

Many of these victims don’t even file a police report, out of shame or disbelief.

And, unless the planets align (a victim who reports quickly and well, a qualified public official, funds that end up at an exchange or in freezable tokens), the outcome is dreadful.

Attacks on big exchanges aren’t the most frequent. They’re just the ones everyone sees.

Seed compromise. A photo on your phone, a note in the cloud, an email to yourself. Nobody asked for the words: they simply leaked.

Signature phishing. You sign an off-chain message that authorizes third parties to move your tokens, and they leave whenever the attacker wants. Think of a blank signed check, forgotten in a stranger’s drawer. In January 2026 alone, that came to $6.3 million.

Wrench attack. The name comes from the wrench. No cryptography withstands a physical threat against you or your family. In the first half of 2026, CertiK counted 52 of them, totaling $124 million; 33 in France alone.

Address poisoning. The scammer plants in your history an address almost identical to a legitimate one. On your next transfer, you copy the wrong one. A single case, in January, cost $12.25 million.

Device failure. On July 29, ColdCard users who had never connected their device to the internet were drained because of a randomness flaw in key generation. More than a thousand bitcoins. I analyzed the case in “Not your keys, not your coins — but do you know how your keys are generated?“.

Notice: in each case, the victim trusted something. The support line, the cloud, the website, their own discretion, the transaction history, the firmware. And, in every case, they trusted their own ability.