Binance's reported mega-hack shows custody is still crypto's weak spot

Crypto was supposed to remove the need to trust a middleman with your money. So why does the biggest story of the week involve a middleman losing, reportedly, billions of it?

Here is what is known so far, and the numbers are still moving. Binance said it was aware of "a potential security issue" and had "not confirmed any impact to user funds," according to Express. It paused withdrawals. Early reports said $2.8 billion was suddenly withdrawn, with more than $2 billion in Ethereum and tokens leaving hot wallets for an address created hours earlier. Later tallies went higher: an on-chain count cited by Yahoo Finance puts the drain at $5.57 billion across three blockchains, with Tether and Circle freezing $1.8 billion. Founder Changpeng Zhao said losses might exceed $1 billion but would be covered. These figures conflict, and Binance has not confirmed the total. Treat the headline number as an estimate.

Separately, Polymarket paused trading after one of its third-party providers was compromised and some users saw their accounts drained. Wired reports that trading has resumed and affected traders will be made whole. Reports put the losses in the low millions. Polymarket blames a third-party provider, and the two incidents appear to have simply landed on the same day.

The failure keeps showing up in the same place

Different scale, different mechanics, same lesson: somebody holds keys or access on behalf of users, and when that somebody is breached, users pay the price. At Binance, the reported loss came from hot wallets, the part of an exchange that has to stay connected so it can process withdrawals. At Polymarket, it was a vendor in the chain. Binance has not said how the attackers got in, so we can't say what failed there. But nothing reported so far points to an exotic cryptographic break, and our bet is ordinary operational risk wearing a blockchain costume.

That is the uncomfortable point. The protocols underneath these systems can be sound while the businesses wrapped around them remain a single point of failure. We think the industry still sells "decentralized" as a vibe while asking users to deposit funds into very centralized buckets.

Proof-of-reserves is necessary, and nowhere near enough

The tempting reaction is to demand proof-of-reserves from every exchange. We agree, with a caveat. Proof-of-reserves tells you whether the assets exist. It says little about whether an attacker can walk out the door with them tomorrow. A solvent exchange with sloppy hot-wallet controls is still one bad afternoon from a freeze on withdrawals.

So the demand should be broader: published, independent security audits; clear disclosure of how much sits in hot versus cold storage; and a vendor-risk story that goes beyond "a third party was compromised." Polymarket's case is a reminder that your security is the weakest supplier you depend on.

Regulators have a role here too. Disclosure standards that make exchanges report custody architecture and incident response, in plain language, would do more than another round of reassuring tweets. "User funds are safe" is a sentence, not an audit.

The rescue was centralized too, and that cuts both ways

One irony deserves attention. Much of the damage control came from stablecoin issuers. Tether froze more than 1.567 billion USDT, and Circle's Jeremy Allaire said it froze more than 800 million USDC in coordination with law enforcement. Zhao also thanked Ripple for freezing roughly $200 million. That is good news for anyone with money at stake this week. It also shows that assets sold as "permissionless" can be switched off by a few companies when they decide to.

We would not call that a flaw. It is a trade-off the industry rarely states honestly: the same centralization that creates the single point of failure also provides the emergency brake. And the brake only works on assets someone controls. One unverified breakdown circulating online claims the haul included about $1.45 billion in Bitcoin and $875 million in Ether. Treat those numbers with caution, but if they are anywhere near right, a large share of the loss sits in assets that issuers can't simply freeze.

Treat your exchange balance as a loan, not ownership

If you keep funds on an exchange, think of that balance as a loan to a company, not as ownership. Keep on a platform only what you are willing to see frozen for days. Move long-term holdings to self-custody if you can manage the responsibility, and be skeptical of any platform that answers a breach with comfort instead of data.

Our verdict: Binance may well cover every user, and we hope it does. But Zhao's "will cover" is a promise, not a safeguard, and he himself noted he no longer manages Binance and spoke as a shareholder. The industry will keep having weeks like this until users, and the regulators who speak for them, make verifiable security a condition of doing business rather than a marketing line.