Binance, crypto and hacks: What to know about keeping coin safe as cyber criminals advance

Key points

• Binance was hacked on Oct. 29 with an estimated impact of $6.3 billion, and about $3 billion of the stolen assets has been frozen so far.
• Crypto investors lack legal protections equivalent to FDIC insurance, and repayment after a hack depends on the exchange's willingness and ability to cover losses.
• Security experts say moving crypto offline trades one kind of risk for another and does not remove risk entirely.

Binance, the world's largest crypto exchange, was hacked on Oct. 29 with an estimated impact of $6.3 billion, raising questions about the recovery of stolen funds and the broader fallout for crypto markets. About $3 billion of the stolen assets has been frozen so far, according to a Binance security update. In a Saturday update, the exchange said it had replenished 90% of stolen assets and was committed to covering the remaining 10%.

Blockchain investigators at TRM Labs and Chainalysis have linked the attack to North Korea, but neither the U.S. government nor Binance has publicly confirmed any source for the hack. The incident highlights the lack of protections for crypto investors, who do not have an equivalent to the Federal Deposit Insurance Corporation's $250,000 coverage for bank deposits.

No FDIC equivalent for crypto

Josephine Wolff, professor of cybersecurity policy at The Fletcher School at Tufts University, said there "really aren't any legal protections for crypto assets equivalent to FDIC insurance." Customers could try to sue a hacked exchange or recover funds in bankruptcy, but "there's no guarantee of compensation," she said.

Michael Tanguma, co-founder and CEO of Onramp Bitcoin, said customers are usually repaid after an exchange hack "but only because the exchange decides to pay and has the money to do so." He added that "nothing in the law requires it to."

The Protection Fund was created for moments like this and absorbed the financial impact of the incident

— Gracy Chen

Risks of self-custody

Tanguma said the stolen funds came from wallets the exchange keeps connected to the internet to process withdrawals, not from offline reserves. He said every custody setup has a weak point, and for self-custody that point is the individual, citing risks such as a lost device or a family unable to reach funds after a death.

Ryan Reck, founder of Reck Advisory, said "crypto has no undo button" and that once a transfer confirms, there is no chargeback. Sarah Downey of the insurance brokerage Lockton said whether investors can recover funds depends on factors including how quickly a theft is discovered and whether the exchange has insurance or enough reserves.