Binance breach wipes out $6.3 billion, leaving users without federal backup

Binance lost access to approximately $6.3 billion in client assets on Thursday in what is now the largest cryptocurrency theft on record. The breach occurred on the company's offshore platform, leaving investors holding funds in digital wallets vulnerable to loss without the safety net of traditional banking. While the exchange promised to cover the costs, the incident underscores a gap in protection for those who store crypto on third-party exchanges.

The theft happened alongside another security failure. Earlier on Thursday, prediction market platform Polymarket halted trading on its international exchange after a third-party data provider was hacked. At least $2.7 million was drained from user wallets on the Polygon blockchain. These two events in a single day have intensified scrutiny on how exchanges protect user funds.

Tyler Moore, a cybersecurity professor at the University of Tulsa, described the current state of affairs as dangerous. He noted that banking customers have the Federal Deposit Insurance Corporation to protect deposits up to $250,000 per insured bank. No similar coverage exists for funds lost in a cryptocurrency exchange hack. Moore advised that individuals be wary of leaving large amounts of money in these venues because there are no built-in protections when breaches occur.

Ido Ben-Natan, CEO of blockchain security company Blockaid, offered a different perspective. He stated that users should not lose money because Binance said it would cover everything. Ben-Natan argued that exchanges need to work harder to prevent future hits, but he believed the industry would become stronger. He suggested that crypto wallets could eventually become safer than other options as companies gain experience handling attacks.

A key distinction emerged between offshore and domestic platforms. Binance's regulated, centralized U.S. exchange was not affected by the breach. The same was true for Polymarket's domestic exchange. U.S. platforms Coinbase and Robinhood were also unaffected, though their shares fell on Friday in response to the news.

Michael Selig, Chairman of the Commodity Futures Trading Commission, spoke on CNBC's Squawk on the Street on Friday. He emphasized that offshore incidents lack the safeguards found in U.S. financial markets. Selig said the agency wants to offer a federal option for exchanges to register with the CFTC. This would subject them to the same cybersecurity standards as current U.S. markets.

Brett Falk, a professor at the University of Pennsylvania, noted that current U.S. regulations likely would not have stopped the Binance hack. The breach may have involved a compromised DevOps engineer's laptop, according to a post by Binance on X. Falk explained that most regulations do not dictate the specific software stack used to authenticate people. Binance later posted that its investigation uncovered additional points of breach, though it did not specify them.

Ryan Kirkley, CEO of Global Settlement Network, advised traders to be cautious. He stated that there is no common solution in the marketplace where assets are truly safe unless a reputable broker-dealer provides asset insurance. He warned that putting money into any ecosystem without such backing risks the assets due to the unknown nature of the threat.