Last week, the Binance crypto exchange announced that cryptocurrency worth approximately USD 6.3 billion had left its hot wallets in unauthorized withdrawals. According to the exchange’s preliminary findings, the attacker may have used a compromised laptop belonging to a DevOps employee to gain access to an internal service that made it possible to submit unauthorized transactions. Binance said it has so far found no evidence of a private key leak and is still investigating exactly how the attack unfolded. What does the incident reveal about the security of crypto exchanges, and how can investors better protect their assets? Miloš Mázor, CEO of Madison Six, which operates the crypto4me platform, discusses these questions. He has been involved in cryptocurrency investing since 2018.
The recent security incident at Binance has reopened the question of how safe crypto exchanges really are. What should we take away from events like this, and should they change the way ordinary investors handle their cryptocurrencies?
I consider it most important that investors know who they are entrusting their cryptocurrencies to and how they are secured. The size of a platform or how well known it is does not in itself guarantee security. An exchange has its place for active trading, but for long-term holding I would always consider a personal hardware wallet as well. An attack on one company’s infrastructure also does not mean that someone has broken the Bitcoin network itself.
I think the market’s reaction is also worth noting. Given the scale of the incident, the drop in the price of Bitcoin does not strike me as particularly sharp. Equity markets, especially tech stocks, were also weakening at the same time. The entire price movement therefore cannot automatically be attributed to the Binance hack; part of it may be related to investors’ generally lower appetite for risk.
I see this as a sign of greater robustness and maturity of the market. I believe that a few years ago, news like this would probably have triggered a much stronger panic reaction. The market is larger today and has a broader investor base, so even a record theft in nominal terms carries a different relative weight. Of course, this in no way diminishes the seriousness of the security failure or the harm to the affected clients.
You might be interested in: Solana has undergone its biggest change in six years
In connection with the attack, there has been talk of so-called hot wallets, which are connected to the internet. What is the difference between them and cold wallets, and how should a well-secured exchange divide funds between the two types of storage?
Put simply, it comes down to whether the funds can be handled through a system connected to the internet. Hot wallets make it possible to process withdrawals quickly, but they are more exposed to remote attacks. With cold storage, the private keys remain outside the online environment. In both cases, the cryptocurrencies themselves are recorded on the blockchain; what is offline is the means by which a transaction is approved.
In my view, hot wallets should hold only the amount needed for day-to-day operations. The bulk of the assets should be stored in an environment with restricted access, segregated permissions and stricter control mechanisms. There is no universally correct percentage, though; it depends on the volume of withdrawals and how the particular service operates. Transfer limits and independent approval of top-ups to operational wallets are also important. Even cold storage will not help if the people operating it approve a fraudulent transaction.
According to analyses so far, the attacker may have abused an internal transaction-signing system rather than directly obtaining a private key. What does a scenario like this say about the security weaknesses of large crypto platforms?
It shows that security does not end with the private key itself. An attacker does not have to steal it if he can get a legitimate system to sign an unauthorized transaction on his behalf. The blockchain can then verify a valid signature, but it cannot tell that the transaction went against the client’s wishes or the exchange’s rules.
Access management and control over what is actually being signed are therefore just as important as protecting the keys. In the case of Binance, though, I would not draw a final technical conclusion yet. The company said it had found no evidence of a private key leak, while at the same time acknowledging multiple points of infrastructure compromise. The exact course of the attack will have to be clarified by the investigation.
What security measures should a crypto exchange have in place so that the compromise of a single system cannot lead to a large-scale loss of client funds? And what role does European regulation, in particular the DORA regulation, play in this area?
A system must assume that an individual computer, account or employee may be compromised. Such a failure should not make it possible to freely dispose of all client assets. The foundation is the separation of powers and access rights, transaction limits, ongoing monitoring of unusual transfers and the ability to halt them quickly. Significant operations should go through genuinely independent approval. Multiple signatures are not enough if all the approving persons rely on the same compromised system.
DORA is important in this respect because it turns technology risk management into an enforceable obligation. Since 17 January 2025, it has also applied to crypto-asset service providers authorized under MiCA. It covers information and communication technology (ICT) risk management, the handling and reporting of major ICT-related incidents, digital operational resilience testing and the management of risks associated with external ICT service providers. No regulation can guarantee that an attack will not happen. But it creates a framework in which a company must manage security systematically and be able to restore operations.
At Madison Six, we meet the security and operational obligations that apply to us as a licensed provider, including the requirements of MiCA and DORA. For the crypto4me service, we use multi-factor authentication, encryption and regular penetration tests. Obtaining a license does not end our work on security; it is a permanent part of our operations.
Don’t miss: Top 10 cryptocurrencies under 1 dollar
In connection with the incident, the EIP-7702 technology has also been mentioned, which makes it possible to extend the functionality of ordinary crypto wallets. Could its abuse pose a risk to small investors as well? How can they tell that they are granting a dangerous permission when using their wallet?
Yes. EIP-7702 allows a regular account on Ethereum to use smart contract functions, for example to bundle multiple actions or let someone else pay the transaction fee. In the process, the user signs an authorization that assigns specific program code to their account. If a user authorizes the assignment of malicious or untrusted code, an attacker may gain the ability to perform certain operations with their funds, within the scope of the permissions arising from that code. Such a setting can persist even after the original transaction is completed.
Warning signs include an unexpected request for a wallet “upgrade,” a delegation, or a signature whose consequences are not clearly explained. The fact that no immediate payment is displayed does not mean the signature is harmless. If I don’t know exactly what I am approving and for whom, I won’t confirm it. Moreover, simply disconnecting from a website does not cancel a delegation that has already been granted. Even a hardware wallet will not prevent users from signing a dangerous permission themselves. The role of EIP-7702 in the specific attack must be assessed on the basis of verified technical findings.
The European Union is gradually introducing MiCA rules for providers of crypto-related services. From the perspective of an ordinary investor, what is the practical difference between using a licensed and an unlicensed platform, especially if a security incident occurs?
Binance, the exchange hit by the current hacking attack, has so far failed to obtain a MiCA license. Our company Madison Six, which operates the crypto4me service, has held one since 18 December 2025, under an authorization from the National Bank of Slovakia. The authorization also covers the custody and administration of clients’ crypto-assets. We have gone through the licensing process and continue to meet the related security, organizational and capital obligations.
With a licensed provider, there is a specific legal entity under the supervision of a European regulator. It must meet capital and organizational requirements, protect client assets and handle complaints. In the event of an incident, the client therefore enters a substantially clearer legal environment. With a foreign unlicensed platform, enforcing their rights may be considerably more difficult.
I would always verify a license directly in the register of ESMA or the national regulator, though. A familiar logo or a claim on a website is not enough. What matters is which company the client is entering into a contract with and which services that company is authorized to provide. Regulation increases the provider’s accountability and transparency, but in itself it does not eliminate operational risk or cryptocurrency price volatility.
Don’t miss: MiCA is starting to truly change the crypto market
After similar attacks, major crypto platforms may promise to reimburse clients for their losses. But what protection are investors actually legally entitled to? And is there anything in the crypto sector comparable to bank deposit insurance?
What matters is the provider’s legal regime, the specific service, and the circumstances of the loss. MiCA stipulates that a custody provider is liable for the loss of clients’ crypto-assets or the means of access to them if the loss results from an incident attributable to the provider. This liability is limited to the market value of the lost assets at the time of the loss. It is therefore not automatic compensation for any damage under all circumstances.
Crypto-assets themselves are not covered by the European bank deposit insurance scheme of up to 100,000 euros. Nor is an exchange’s reserve fund, such as SAFU, a statutory scheme of that kind. With any private insurance, it is necessary to know its scope and exclusions. And even if a client has a legal claim, actual payout also depends on the firm’s financial situation and the enforceability of the claim. A promise of compensation should therefore be assessed on the basis of its specific terms and the subsequent steps taken.
In the event of security incidents, the issuers of some stablecoins can freeze stolen funds. Is this option mainly an advantage for the average investor, or does it also bring certain risks? How does European regulation approach this issue?
In the case of theft, it is a significant advantage, because a quick freeze can prevent further transfers of the stolen tokens. However, it does not mean the money is automatically returned to those who were harmed. Their further fate is decided in the relevant legal process.
At the same time, it shows that such a stablecoin depends on a particular issuer and its powers. A freeze may be related, for example, to sanctions or a decision by a competent authority, and it can temporarily make funds inaccessible even to a person who did nothing wrong. Investors should therefore know who issues the token and under what conditions its use may be restricted.
MiCA regulates the authorization of issuers, the backing of tokens, and the rights of holders of the relevant stablecoins. For e-money tokens, it establishes a right of redemption at nominal value. Obligations related to sanctions and anti-money laundering form a further layer of rules. European regulation brings clearer conditions, but it does not eliminate the issuer’s power to freeze specific tokens.
Behind many large-scale crypto attacks lie not only technical vulnerabilities, but also the human factor and social engineering. What methods do attackers use most often today, and what should crypto users themselves watch out for?
Attackers often look for a way in through the person. They impersonate customer support, colleagues, or business partners, send fake job offers, and try to get the victim to install a program or approve a fraudulent request. In targeted attacks, they may spend weeks building trust. Artificial intelligence also makes it easier for them to create convincing messages as well as fake voice or video.
According to publicly available information and the conclusions of US security authorities, the attack may be linked to a North Korean hacker group. The exact technical course of the attack remains the subject of investigation.
For users, the main takeaway is the need for independent verification. Even a familiar name on the screen is not sufficient proof of identity. I would verify any unexpected request to install an application, grant remote access, or transfer money through another, previously known contact.
You might be interested in: Top Crypto Podcasts
After major hacker attacks, fraudulent compensation offers and fake customer support also often appear. How can an investor recognize such a scam, and what information should a legitimate provider never ask for?
Scammers exploit fear and urgency. They claim, for example, that you must immediately connect your wallet to a compensation website, pay an unlocking fee, or transfer funds to a “safe address.” An unsolicited private message from alleged support is also suspicious.
Legitimate support will not ask a client for a seed phrase, private key, or password. Nor should it ask for one-time login or authorization codes to be dictated to it. Entering a code into the official app when logging in yourself is a different situation from telling it to a stranger. Requests to sign a transaction or grant a permission should be treated with the same caution.
I would contact support myself through the official app or a manually opened website. If it is necessary to prove your identity or a transaction, it must be done through a verified channel. A demand to pay an alleged tax or deposit for the return of stolen cryptocurrencies is a strong warning signal.
Incidents like these may prompt some investors to move their cryptocurrencies from an exchange to their own wallet. When does self-custody make sense, and when, conversely, may it be safer to use a regulated provider?
For long-term holding, I consider a hardware wallet a suitable solution, provided the investor understands how to use it and can securely store the recovery phrase. They gain direct control over their funds, but at the same time take on responsibility for backups, the correctness of transfers, and any inheritance. No customer support can issue them a lost seed again.
For someone who would store the recovery phrase on their phone, send it by email, or regularly confirm unknown requests, quality regulated custody may be safer. It can likewise be practical for active trading. What matters is comparing the real risks of both options with your own abilities. For many investors, a combination makes sense: keep the long-term portion separately and leave the funds intended for trading with a provider.
Some exchanges temporarily suspend withdrawals and transfers during security incidents. How can a client distinguish a precautionary security measure from more serious problems with the platform’s operation? And how much does so-called proof of reserves help in assessing an exchange’s trustworthiness?
A suspension of withdrawals on its own does not necessarily mean insolvency. During an attack, it may be necessary to prevent further losses. A client should monitor how specific and regular the communication is, the scope of the restrictions, and whether the announced steps are actually being carried out. Warning signs include repeatedly postponed deadlines without explanation or a demand for an additional deposit as a condition for withdrawal. But even good communication does not in itself prove a firm’s financial health.
As of November 1, Binance announced a gradual resumption of withdrawals and the replenishment of approximately 90 percent of the stolen assets from its own resources. Restoring coverage of client balances is not the same as recovering the stolen funds from the perpetrators.
Proof of reserves can help verify selected assets and, depending on the method used, their relationship to reported client balances. However, it usually does not provide a complete picture of all liabilities, any encumbrances on assets, or the quality of internal controls. It is a useful piece of the puzzle, not a full audit of a firm’s finances or a guarantee of future availability of withdrawals.
Don’t miss: TOP 10 Countries with the Fastest Cryptocurrency Adoption
If you were to recommend a few basic rules to the average European investor to follow when holding and trading cryptocurrencies, what would they be?
I would start with your own strategy: knowing why you are buying cryptocurrencies, for how long, and what decline you are able to bear both financially and psychologically. The size of an investment should correspond to your overall wealth and should not endanger your everyday budget. Making decisions under pressure from a rapid price rise or fear of a drop tends to be expensive.
Next, I would verify the provider and the method of custody. I would protect my account with a strong, unique password and multi-factor authentication, ideally a security key or passkey, if the service supports them. I would keep the recovery phrase of my own wallet offline and never share it with anyone.
Before every transfer, I would check the entire address and the correct network, and for a new address I would first send a small test amount. I would not sign permissions I don’t understand, and I would keep educating myself continuously. I consider it most important to understand that investment strategy and custody security go hand in hand. A good purchase decision can be undone by a single unnecessary security mistake.
Photo source: archive of Miloš Mázor
