Crypto Exchange Hacks and What You Shouldn't Conclude From Them
In October 2026, Binance suffered the largest crypto theft in history when $6.3 billion left its wallets in twenty minutes, yet the exchange restored 98% of the assets with its own funds within two days.
The entry point, according to Binance itself, was an engineer's computer, infected after a fake job interview. Two days later, Binance announced it had restored 98% of the assets with its own funds; the next day, it resumed withdrawals. This quick recovery contrasts with the narrative that self-custody is inherently safer than exchanges.
Major crypto hacks like Mt. Gox (2014), QuadrigaCX (2019), FTX (2022), Bybit (2025), and now Binance (2026) often lead to the same conclusion: 'not your keys, not your coins.' While technically true—if you don't hold the private key, you don't control the asset—this conclusion oversimplifies the security landscape.
The Visible vs. Invisible Losses
When an exchange is attacked, the whole world sees it. There are billions at stake, official statements, and international coverage. When an individual loses everything, almost nobody finds out. Many victims don't even file police reports out of shame or disbelief.
In January 2026 alone, various self-custody failures cost millions: an investor lost $282 million after reading his hardware wallet's seed to a scammer posing as Trezor support; signature phishing attacks came to $6.3 million; address poisoning cost $12.25 million; and device failures affected ColdCard users.
False Dilemma of Custody
Every form of custody carries risk. Whoever leaves assets on an exchange trusts its governance and solvency. Whoever self-custodies trusts themselves, their device, the software, and whoever knows they own crypto. The problem is acknowledging the first and ignoring the second.
There's no option without trust. There's conscious trust and ignored trust. The most expensive risk is the one you don't see. The solution lies in diversifying: part on a solid exchange (or three), part in well-done self-custody, part in ETFs—perhaps 30%, 40%, and 30% depending on your knowledge, profile, and goals.
Recovery After Attack
In self-custody, there's no one to call. The January $282 million theft began conversion to Monero immediately. Freezes only happen when funds touch an exchange or stablecoin issuer. Full recovery is the exception.
Custody isn't choosing whom not to trust. It's choosing, consciously, whom to trust, what
On exchanges, there's a counterparty. Bybit restored customer funds in three days after its $388 million hack. Binance took on 100% of the loss and restored 98%, verifiable in its proof of reserves. Mt. Gox creditors waited a decade and got back only 15% of their bitcoins, while FTX creditors received cash worth about 120% of their assets at collapse value.
Related
