The Payment Expert Podcast examined how one compromised laptop led to the largest crypto theft on record at Binance, and what protections exchange customers have when their platform is breached.
Last week, hackers moved approximately $6.36bn out of Binance wallets on ten blockchains on 29 October, most of it in about 20 minutes. TRM Labs attributed the attack to TraderTraitor, North Korea’s state-backed hacking unit, and the FBI has since said North Korea was responsible.
Binance said its initial investigation pointed to a compromised laptop, which let an attacker reach a service container and submit unauthorised withdrawal transactions.
The podcast discussed how access through an employee’s device made the withdrawals appear authorised until the funds had left. Binance later said it had found additional points of breach and has yet to publish a full post-mortem.
Elsewhere, Mercado Bitcoin lost assets from its hot wallets on 2 November, with Chainalysis estimating about $49m was drained across 17 blockchains. Hot wallets stay connected to the internet and pool customer funds, which the podcast said makes them a target. Brazil’s largest crypto exchange said customers would not lose assets, with an attacker not yet named.
The podcast noted neither attack used a new technique, and that attackers are targeting the largest exchanges.
Binance a part of exchange concentration?
Most holders leave their crypto with an exchange rather than run their own wallet, which the podcast said has concentrated both assets and risk in a few platforms. Binance accounted for 42.7% of spot volume across the ten largest centralised exchanges in Q3 2026, up from 38.7% in Q2, according to CoinGecko.
The response to the hack also relied on central control. Tether froze about $1.6bn of USDT linked to the theft, and Circle CEO Jeremy Allaire said his firm froze more than $800m of USDC. The team discussed how freezes and corporate reserves differ from crypto’s founding promise that no single party controls the system.
Who covers the losses?
Binance has set aside about $6.34bn of company funds to cover all losses, alongside its Secure Asset Fund for Users (SAFU), which holds about $1bn. It has no legal obligation to do so. The podcast said the pledge protects the exchange’s standing with its 323 million registered users, but leaves open what happens if a future hack exceeds what it can pay.
Bank customers in most markets have a statutory backstop, such as the US Federal Deposit Insurance Corporation’s cover of up to $250,000 per depositor per bank. The nearest crypto equivalent is Article 75 of the EU’s Markets in Crypto-Assets Regulation (MiCA). It makes authorised custodians liable for client losses from incidents attributable to them, capped at market value at the time of loss.
Binance falls outside it because it withdrew its MiCA licence application in Greece in June and stopped serving EU customers. It remains among the largest crypto exchanges globally with a presence in more than 100 countries.
The latest episode of the Payment Expert Podcast is available now on Spotify, YouTube, Apple Podcasts, and all major podcast platforms. Subscribe to the Payment Expert newsletter to make sure you don’t miss an episode.
