By DC member Felix Zuckschwerdt, Head of Mission East & Southern Africa of the Diplomatic Council.
Twenty minutes, ten blockchains
On 29 October 2026, attackers drained roughly USD 6.3 billion from Binance, the largest crypto exchange in the world. According to the analytics firm TRM, most of the money left Binance wallets across ten blockchains in about twenty minutes. It is the largest theft in the history of digital assets, more than four times the USD 1.5 billion taken from Bybit in February 2025.
The early response was fast. Binance, Tether, Circle and other partners froze around USD 3 billion on-chain, and Binance has said it will cover all customer losses from its reserves. Blockchain analysts, including TRM and Chainalysis, attribute the attack to the North Korean state-linked group known as TraderTraitor, the same unit the FBI connected to Bybit.
Reports point to a familiar entry point: a single compromised laptop. For anyone who builds and runs regulated crypto infrastructure, that detail matters.
The chain held. The operator did not.
No blockchain was broken in this attack. Bitcoin, Ethereum and the other networks did exactly what they were designed to do: they executed valid, signed instructions. The problem is that the instructions were signed by people who were not subject to sufficient institutional governance.
This is the pattern behind almost every large crypto loss of recent years. The cryptography is sound. The weak points are the people, devices and processes that hold the keys and approve the transactions. Cornell economist Eswar Prasad made a similar point in the Financial Times this week, arguing that the vulnerabilities sit in the ecosystem around blockchains rather than in the ledgers themselves.
From an operator’s seat, I would put it more bluntly. A centralised exchange is a bank-like institution with a blockchain at the back end. Its security depends on the same things as any bank: endpoint hygiene, privileged access, segregation of duties and the discipline to say no to an urgent request. When one engineer’s laptop can become the path to billions, the issue is architecture and governance, not technology.
Why Europe’s rulebook matters now
Europe has already drawn conclusions that the rest of the market is still debating. Under MiCAR, crypto-asset service providers must be licensed, safeguard client assets and keep them segregated from their own. Under DORA, which has applied to the financial sector since January 2025, they must also manage ICT risk with the same rigour expected of banks and insurers.
In practice, this means documented key management, tested incident response, strict control of privileged access, third-party risk assessments and regular resilience testing. None of these rules would make an exchange immune to a state-sponsored attacker. They do raise the cost of an attack, and they reduce the chance that a single device or a single person becomes a single point of failure.
The Binance case is a strong argument for regulation that is proportionate but real. Self-custody and decentralised finance will keep their place. Most users, however, will continue to hold assets with intermediaries because it is convenient. Where they do, the intermediary should be held to the standards of a financial institution, because that is what it is.
Five lessons for every operator
Every exchange, custodian and crypto payment provider should be asking the same questions this week. Based on my own work in regulated financial IT, these are the five I would start with:
- Treat signing devices as critical infrastructure. Keys and approval workflows belong on hardened, dedicated hardware, never on general-purpose laptops used for email and browsing.
- Require independent approvals for large movements. Multi-party computation or multi-signature schemes only help if the approvers sit on separate devices, separate networks and ideally in separate locations.
- Verify what is being signed. Both Bybit and now Binance show that attackers manipulate the transaction an approver sees. Out-of-band verification of destination and amount is essential.
- Limit the blast radius. Hot wallets should hold only what daily operations need, with velocity limits that stop or slow outflows of unusual size.
- Prepare for the first twenty minutes. The USD 3 billion frozen at Binance shows the value of pre-agreed contacts with stablecoin issuers, analytics firms and other exchanges. That playbook must exist before the incident, not during it.
A question of statecraft, not only security
If the attribution holds, this was not a crime by a lone hacker. It was revenue generation by a sanctioned state. Funds stolen from crypto platforms help finance programmes that the international community has spent decades trying to contain.
That makes crypto security a foreign policy matter. No single regulator can trace funds that cross ten blockchains and dozens of jurisdictions within minutes. Effective response depends on cooperation between financial intelligence units, law enforcement, stablecoin issuers and private analytics firms, often across borders that do not share legal frameworks.
This is especially relevant for emerging markets. In much of Asia, Africa and South America, digital assets and stablecoins are becoming real tools for payments and remittances. These regions stand to gain the most from secure digital finance and lose the most from a collapse of trust. Building supervisory capacity and cross-border information sharing there is an investment in both financial inclusion and international security.
Trust is the real asset
Binance will very likely absorb this loss, and markets will move on. The lesson should not. Digital finance is only as strong as the institutions and controls that sit between users and the blockchain. Regulators, operators and governments now share responsibility for making that layer as resilient as the technology beneath it. Trust, once lost at this scale, is far harder to recover than six billion dollars.
Felix Zuckschwerdt is Head of Mission East & Southern Africa at the Diplomatic Council. He leads IT at a MiCAR-licensed crypto-asset service provider in Liechtenstein and has spent more than two decades in financial services technology and cybersecurity.
