On October 29, within about 20 minutes, $6.3 billion flowed out of Binance's wallets. This is the largest theft in crypto history, more than four times the size of the February 2025 Bybit hack.
According to the exchange's own account, the entry point was an engineer's computer—he was compromised after a fake job interview.
Two days later, Binance announced it had restored 98% of assets using its own funds; one day after that, withdrawals resumed.
Remember that last fact. It is the most important one, and the least discussed.
To the man with a hammer, everything looks like a nail
Mt. Gox (2014), QuadrigaCX (2019), FTX (2022), Bybit (2025), Binance (2026)—here are just the most notorious few. The problems differ, but the answer is always the same: self-custody. After all, "not your keys, not your coins."
This premise is technically correct. If you don't hold the private keys, you don't control the assets: all you own is a claim against the holder.
But the conclusion people usually draw from this is not "self-custody is necessarily safer."
The graveyard of the defeated is quiet, unless the defeated are large enough
When an exchange is attacked, the whole world sees it. Billions of dollars in exposure, an official statement, wall-to-wall international coverage.
But when an individual loses everything, almost no one ever knows. Even if the loss happens on-chain and is strictly speaking public, how many ordinary people will go dig through blockchain investigations? The public only sees the news.
Many of these victims don't even file a police report—out of shame, or out of disbelief.
On the investigator's side, the scene is always familiar: the victim shows up with a transaction hash, hoping someone can "freeze those bitcoins."
Unless all the conditions happen to line up (the victim reports in time with complete materials, encounters a competent public official, and the funds eventually flow into some exchange or a freezeable token), the outcome is often very bad.
Attacks on large exchanges are not the most frequent. They are just the kind everyone can see.
A curated menu of self-custody risks
Voluntarily handing over your seed phrase. On January 10, 2026, an investor read out his hardware wallet's seed phrase to a scammer impersonating Trezor support. He lost 1,459 BTC and 2.05 million LTC, worth more than $282 million. The device worked perfectly; it was its owner who failed.
Seed phrase leakage. A photo on your phone, a note in the cloud, an email to yourself. No one asked you for that string of words: they simply leaked out on their own.
Signature phishing. You sign an off-chain message authorizing a third party to transfer your tokens, so the attacker can move them whenever they like. Like a signed blank check left in a stranger's drawer. In January 2026 alone, such losses reached $6.3 million.
Ironically, the Binance theft was also carried out through signatures. The exchange's system was tricked into signing 50 authorizations at once, and just one of them was enough to hand a wallet with $2.2 billion in losses to the attacker—in a single transaction.
Wrench attacks. The name comes from the wrench. No cryptography can withstand physical threats against you or your family. In the first half of 2026, CertiK counted 52 such incidents totaling $124 million; France alone had 33.
Address poisoning. Scammers plant an address in your transaction history that is almost identical to a legitimate one. On your next transfer, you copy the wrong one. A single case in January this year resulted in $12.25 million in losses.
Device failure. On July 29, the assets of a group of ColdCard users who had never connected to the internet were emptied, due to a randomness flaw in the key generation process. Losses exceeded one thousand bitcoins.
Note this: in every one of the above scenarios, the victim trusted something. A support hotline, the cloud, a website, their own judgment, their transaction history, firmware. And in every scenario, they also trusted their own ability.
Self-custody or exchange? A false dilemma
Any form of custody carries risk. Those who leave assets on an exchange trust its governance and solvency; those who self-custody trust themselves, their devices, their software, and everyone who knows they hold bitcoin. The problem is: people acknowledge the former but ignore the latter.
There is no option that requires no trust. There is only trust that is recognized and trust that is ignored. And the most expensive risk is the one you cannot see.
No one would stuff all their wealth under the mattress, nor put it all in a single bank.
The logic should be the same for crypto assets: put part on a solid exchange (or three), part in proper self-custody, and part in ETFs—say 30%, 40%, and 30%. The exact proportions depend on your knowledge, your situation, and your goals. This responsibility cannot be outsourced. Bad news, but better to know now than later.
The day after tomorrow
Taking responsibility can reduce risk, but it cannot eliminate it. So don't just ask "which option is safest for me," also ask "what happens to me after an attack."
In self-custody mode, there is no one you can turn to. The $282 million from January this year almost immediately began being converted into Monero. Freezing is only possible when the funds reach a stablecoin issuer or an exchange. Full recovery is the exception.
In exchange mode, you still have a counterparty. Bybit restored customer assets within three days; Bitget covered the $388 million stolen in September with its protection fund.
Binance absorbed 100% of the losses and has already restored 98%, which can be verified in its proof of reserves.
Of course, a counterparty is only worth something if it is solvent. And it may not return exactly what you originally held.
Mt. Gox creditors waited ten years and got back only about 15% of the bitcoin they "owned." Thanks to appreciation over that period, however, the value of that small fraction is several times their entire 2014 balance.
FTX creditors received cash, not the crypto assets in their accounts: about 120% of the value at the time of the November 2022 collapse, when bitcoin was near $16,000. That is more than the value at the time; but far less than today's value.
How to choose the safest crypto exchange
That is precisely why the three resolutions issued by the Central Bank of Brazil (BCB) in 2025—No. 519, No. 520, and No. 521—matter.
For investors, what matters most is not whether an exchange is regulated by the central bank, but which requirements it must meet: client assets segregated from the company's own assets, held in separate wallets, proof of reserves provided and independently audited, and prohibited from being used for the company's own business.
Conclusion
"Not your keys, not your coins" is about control, not security.
Those who pull all their wealth out of exchanges have not stopped trusting. They have merely transferred that trust, almost always to themselves, without ever asking: do I deserve that trust?
Custody is not about choosing whom not to trust, but about consciously choosing whom and what to trust.
