The Largest Crypto Hack Ever Was Paid For by the Exchange Not Its Users

By EC Assets · Published 2 November 2026 · Updated 2 November 2026

Late on Thursday, attackers took around $6.3 billion from Binance's hot wallets. It is the largest digital-asset theft on record. The FBI has attributed it to North Korea.

By Sunday, withdrawals were reopening. Binance processed $4.65 billion in withdrawals and $1.01 billion in deposits that day, a net outflow of $3.64 billion, or roughly 2% of its assets (CNBC).

The exchange says users will not bear the loss. Most will call that a crisis contained.

Look at how it was contained. Binance does keep a reserve built for exactly this event: a user protection fund holding roughly $1 billion (CNN).

That safeguard covered only a fraction of the loss. The rest came from the futures insurance fund and the corporate treasury.

So the protection that mattered most was not planned. It was a decision, backed by a balance sheet.

In regulated markets, client assets are segregated and trades are centrally cleared. That protection is in place before anything goes wrong, and it does not depend on the firm in the middle choosing to pay.

Protection that relies on a counterparty's capacity to absorb a loss is only as strong as that counterparty on its worst day. This time, the worst day was affordable.

Counterparty risk rarely shows up in returns. It arrives all at once, as capital you cannot reach.

At EC Assets, we treat where capital sits as part of the risk budget, not an operational footnote.

Return on capital assumes the capital is still there.