Investigators think it started with a fake job offer. Someone got tricked into loading bad software. Then on Thursday evening, in about 20 minutes, $6.3 billion left Binance's wallets. The emergency fund built for a day like this held $1.23 billion in bitcoin. Then bitcoin fell, and the fund shrank by another $100 million.
We covered the heist Friday in No. 190. Here's what the weekend Journal adds. Cyber researchers now blame North Korea's TraderTraitor unit, the group that took $1.5 billion from Bybit in February 2025. Elliptic's founder calls it state-sponsored theft on a scale no criminal group comes close to. Tether, Circle and other firms froze about $3 billion of the stolen coins. That leaves about $3.3 billion in the hackers' hands. The group had stolen some $2.6 billion from January 2024 to September 2025. This heist takes its haul past $5 billion. Chainalysis co-founder Jonathan Levin posted that the hackers “are up to their old tricks.”
Binance says it has set aside more than $6.3 billion of company money, the SAFU fund included. About $5 billion of that already sits in the same coins that were stolen. It's buying the last $1.3 billion in the open market. It plans to pay itself back from the frozen $3 billion once that's released. Withdrawals were shut while it checked its systems and should reopen in two days, it said Friday. Binance.US, a separate company, says it wasn't hit. Founder Changpeng Zhao called the remaining gap “(still painful, but) manageable.” His exchange holds $167 billion of crypto across its wallets, user funds included. Next to that, the gap is small.
The fund was the fine print
The lesson isn't that Binance is broke. It's that the insurance was about a fifth the size of the loss. A crypto exchange isn't a bank. There's no FDIC behind the balance. There's an insurance fund, and it's only as big as the coins in it. Those coins fall when the news is bad. Cristiano Ventricelli, a vice president at Moody's Ratings, says big centralized custodians concentrate risk, so one breach does more damage. And the way in was human. A recruiter message, a download, a laptop.
Our read
This is Insurance and Consumer Protection, M11, and the file is custody. The practice holds no crypto in any model book, and our stance hasn't changed since Friday. Coins sitting on an exchange are a promise from that exchange, backed by whatever it holds that day. Bitcoin itself slumped more than 5% Friday, the Journal reports. So the promise shrank while the bill grew.
Here's your check this week. If you hold any crypto, find out where it actually sits and who holds the keys. If it's on an exchange, read what that exchange's insurance fund really covers, in dollars. Then look at your own inbox. The thieves got in through a fake recruiter and a download. Treat any surprise job pitch or partnership link the way you'd treat a stranger at the door. If crypto is more than a small slice of your money, bring it to your next review. Someone else's $6.3 billion lesson is cheaper than your own. Find the umbrella while the sky is still gray.