On October 29, 2026, hackers drained about $6.3 billion from Binance, the largest crypto theft on record. Most of it left in about 20 minutes. This post is the receipt. Crypto is not safe right now, and the reason is not the cryptography. It is four things I have been naming for years: no real regulation, no platform accountability, basic security skipped in the name of client privacy, and naive speculation. Binance is the proof.
The facts are not in dispute. According to TRM Labs, about $6.36 billion left Binance wallets across 10 blockchains starting at 20:05 UTC on October 29, most of it within 20 minutes, and Binance puts its own estimate at about $6.3 billion. Its initial investigation points to a compromised DevOps engineer's laptop, which gave an attacker access to a service container used to submit withdrawals. On Ethereum, pre-signed authorizations under EIP-7702 handed control of a Binance hot wallet to a contract only the attacker could command. Binance says no wallet private keys leaked. TRM Labs and Chainalysis attribute the attack to TraderTraitor, the North Korean unit tied to the $1.5 billion Bybit theft in February 2025. About $3 billion was frozen on chain by stablecoin issuers, Binance says it will cover all user losses from its SAFU fund and company funds, and it paused withdrawals while it rebuilds its withdrawal infrastructure.
Here is what I have been saying. On regulation, I wrote: "I've been saying this for years, the whole crypto industry has been fighting regulation." On platforms that ship first and secure second, I wrote: "So many more people to become victims of crypto scams!!! How about securing your platform first!" And on an exchange that actually stops theft, I wrote: "Crypto isn't the problem, it's the grifters running the infrastructure." I wrote a full post on the Nobitex hack in July 2025, titled "Takeaways from Nobitex: Why Crypto Companies Are Soft Targets and How to Stop Being One." I also shared TRM Labs' finding that in the first half of 2025, more than $2.1 billion was stolen across at least 75 crypto hacks, with nearly 70 percent of it from the single Bybit hack, and with infrastructure compromises accounting for more than 80 percent of stolen funds. North Korea was already the story. Infrastructure was already the story.
Accountability starts with people, and Binance proves it. On an FBI and Justice Department post about North Korean schemes to defraud American companies through remote IT workers, my entire comment was two words: "Vet your employees." This attack started with an engineer's compromised laptop. That is not bad luck. That is an employer that did not control its own devices, its own containers, and its own withdrawal machinery, and then asked customers to trust the result. Covering the loss afterward is not accountability. Accountability is answering for the controls that were missing before the money moved, and it is the part the industry keeps skipping because no regulator is standing there forcing it to do otherwise. The same goes for basic security skipped in the name of privacy and a frictionless experience: vetting that asks questions, signing procedures that slow a withdrawal down, withdrawal limits that cap the damage, all treated as obstacles to growth instead of the job itself.
The customers walking into that gap are speculating on things they do not understand. Retail investors lost billions on memecoins while insiders cashed out through fees and token sales. I called Bitcoin ATMs a "terrible idea" and watched the lawsuits and scam reports pile up, including $124 million in Bitcoin ATM scams against victims over 60 in a single year according to IC3 data cited in that thread. Texas lawmakers are now examining $56.8 million in crypto kiosk losses for Texans alone. Pig-butchering victims lose life savings to operations that run at industrial scale. The platforms profit from the volume whether the customer understands what they bought or not, and nobody in the chain is accountable when they do not.
I never claimed to predict this exact hack. I predicted the conditions that made it possible, and Binance is what those conditions produce when they are all true at the same time: an industry fighting regulation, a platform nobody holds accountable, basic security skipped, and customers speculating on things they do not understand. That is the sense in which I predicted it. Not the mechanism, not the date, but the conditions.
And now, right on cue, comes the second act. Every industry and fintech expert suddenly wants to lead the cleanup and chair the working group. Fine. Where were they on February 13, 2022, at Super Bowl LVI, when Coinbase bounced a QR code around America's television screens offering $15 in Bitcoin to anyone who scanned it, when Crypto.com had LeBron James telling his younger self that fortune favors the brave, and when FTX had Larry David telling viewers not to be like Larry? Four crypto ads on the biggest stage in advertising, selling mainstream America on crypto as the safe, grown-up, inevitable future, while the platforms behind them did none of the basic security work that would have protected the customers they were recruiting. FTX collapsed months later. The cleanup crew was nowhere then, because there was nothing to clean up while the money was pouring in. They had their chance to be experts when it mattered, which was before the stadium ads, not after the heist.
Here is the insulting part. Securing a platform is not hard. Ten easy things, and any platform that cannot do them should not hold your money:
1. Make them accountable to a regulator.
2. Know their client, meaning verify account holders' identity.
3. Limits on size of transactions, per transaction and per day, so one breach cannot drain billions in minutes.
4. Keep most customer funds in cold storage, offline, with only a small hot wallet for daily withdrawals.
5. Require more than one person and more than one device to approve any large withdrawal, so no single compromised laptop can move money.
6. Vet employees, give each job only the access it needs, and separate the people who can request a withdrawal from the people who can approve it.
7. Put a delay and an alert on large or unusual withdrawals, so a customer and a human can stop a theft in progress instead of reading about it afterward.
8. Monitor withdrawals in real time for anomalies and keep a kill switch that pauses withdrawals the moment something looks wrong.
9. Test the defenses with independent audits and penetration tests, and publish the results instead of grading their own homework.
10. Segregate customer funds from company funds, prove it with independent verification, and insure what remains at risk, so "we will cover it" is a funded promise instead of a press release.
That list is not just my opinion. It is what failure looks like in practice across this industry. Look at wallet providers with no checks on how fast money can leave, no flag when a withdrawal comes from somewhere unexpected, and no limits on a single withdrawal. Look at private keys left exposed in a web browser where malware could grab them, marketed as top-tier security, with the fine print saying the loss is the victim's problem because the provider claims it never held the funds. Notice what that describes: a platform missing items 3, 7, and 8 on the list above, and accountability item 1 nowhere in sight. Recovery work in this space makes the same point from the other end. Stolen funds get frozen only when they land at an exchange that actually does KYC and answers a subpoena, which is why item 2 matters after a theft as much as before one.
The custody point comes from the legal side, too. In traditional finance, an investment adviser cannot just hold client assets however it likes. It answers to custody rules, books and records requirements, and a compliance program. The crypto vault ideal is the opposite: unbounded assets with nobody registering anywhere. Even the industry's own proposal for crypto vaults asks regulators to recognize vaults as regulated custodians. That concedes the point. Custody is a regulated function, not a slogan, and a platform that holds billions of other people's money does not get to opt out of it by calling itself decentralized.
I can already hear the replies, so let me save everyone time. "The blockchain wasn't hacked." Oh, wonderful. The vault held while the robbers drove the truck out the front gate. Tell that to the $6.3 billion. The cryptography worked and the money is still gone, which is exactly the point. "Binance covered it, so nobody got hurt." Right, because a multibillion dollar company writing a check after the fact is the same thing as security. By that logic, arson is fine as long as the owner has insurance and a good contractor. "Regulation kills innovation." Yes, how innovative: losing $6.3 billion in 20 minutes. If your business model dies the moment someone asks who you are and how much you can move at once, it was not innovation, it was a loophole with a marketing budget.
"You can't stop a nation-state like North Korea." Funny, banks face nation-states too, and somehow they manage this radical thing called vetting employees, limiting transfers, and reversing fraud. North Korea is good, but it is not magic. It still needs an unvetted laptop and an unguarded withdrawal pipe, and we keep handing it both. "Not your keys, not your coins, just self-custody." Great advice for engineers. Less great for the millions of ordinary people the Super Bowl ads recruited with QR codes and LeBron. Telling victims they should have been their own bank after you sold them a bank is not a security model, it is a disclaimer with a stadium ad budget. "Banks get hacked too." They do, and then deposits are insured, transfers are reversible, and regulators show up with questions that have consequences. Crypto's version is: sorry, the blockchain is immutable, but good news, we have a fund. One of these is a financial system. The other is a casino that hired a PR team.
So here is the pattern. The industry fights the regulation that would force baseline controls. State actors probe for months, get in through an employee or a front end, and walk out through withdrawal machinery nobody reviewed. Then the platform covers the loss, promises a review, and the cycle resets, bigger each time, because the adversary is the same, the gaps are the same, and the money at stake keeps growing. Losses in 2026 already dwarf all of 2025. The deeper point is that reimbursement is not accountability, and a promise to cover the next loss is not a control. Regulation is what turns "we will cover it" from a promise into a requirement, and what forces platforms to do basic security before the hack instead of apologizing after it. Until that happens, the hacks will keep coming. The warnings were specific enough to act on, and they were ignored anyway. And the ten fixes above prove the point: none of this was hard, which is what makes the failure inexcusable.
Gabriel Vincent Tese is an attorney with Spector Gadon Rosen Vinci P.C. in Philadelphia focused on cyber litigation and technology law. He can be reached at gtese@sgrvlaw.com.
This post is general information, not legal advice. For advice about your specific situation, consult an attorney.