The NZ$11.2 billion Binance hack is the strongest case yet for holding your own keys

On 29 October (US time), attackers took about NZ$11.2 billion in crypto from Binance. It is the largest crypto theft on record, more than four times the NZ$2.7 billion taken from Bybit in 2025. (Figures reported in US dollars have been converted at the Reserve Bank’s 30 October exchange rate.)

Binance halted trading and froze withdrawals, then promised to cover every customer’s loss from its own funds. Phased withdrawals restarted on 1 November. For many customers the story may end there. But for a few days, millions of people couldn’t touch crypto they thought of as theirs, and whether they got it back depended on one company’s balance sheet and goodwill.

What happened

According to blockchain analytics firm TRM Labs, the first unauthorised transfer left Binance on the XRP Ledger just after 4pm US Eastern time. Within about 20 minutes, funds were moving out on Ethereum and Bitcoin too. By the end of the evening, assets had been drained across ten blockchains.

Ethereum-based assets made up the largest share, at about NZ$6.8 billion. Around 18,270 bitcoin, worth about NZ$2.7 billion, went with them, along with tokens on Tron, the XRP Ledger, Solana, Avalanche, Polygon and several Ethereum layer-2 networks. One single transaction moved more than NZ$4.4 billion.

The FBI has attributed the attack to North Korea, naming the state-linked hacking group known as TraderTraitor. The same group has been linked to previous large exchange thefts, including the Bybit hack.

“An exchange balance is a promise. A wallet you control is the asset itself.”

How the money was taken

Exchanges keep most customer crypto in offline “cold” storage, but they keep a working balance in “hot” wallets that are connected to the internet so withdrawals can be processed quickly. That convenience is also the weak point: whoever controls the systems that approve hot-wallet transfers can move the money.

Binance says its investigation traced the breach to a compromised laptop belonging to one of its engineers, and that it has since found additional points of breach it hasn’t described. Sky News reported that the attackers likely prepared for at least 36 hours before moving the funds.

In other words, this wasn’t a flaw in Bitcoin or Ethereum. Both networks worked exactly as designed. The failure was inside a company that was holding other people’s keys.

Will Binance customers lose money?

Binance says it will absorb the loss, not its users. It says it set aside more than NZ$11.2 billion of its own money, drawing on its emergency fund for users, its futures insurance fund, its bitcoin reserve and its corporate treasury. On 31 October it said it had restored backing for 90 percent of the affected assets. Those figures come from Binance itself and haven’t been independently verified.

About NZ$5.3 billion of the stolen funds has been frozen, largely by stablecoin issuers Tether and Circle, which can block tokens they issue. Bitcoin can’t be frozen that way, and analysts expect the rest to be laundered. Freezing funds is not the same as getting them back.

The key point for anyone holding crypto on an exchange is that the refund was Binance’s decision. Martin Mulyadi, an accounting professor at Shenandoah University, told CNBC that a discretionary refund is “a goodwill gesture, not a promise”. A smaller exchange, or a larger hack, could leave customers with nothing to fall back on.

New Zealand has been here before

In January 2019, Christchurch-based exchange Cryptopia was hacked and about NZ$30 million in crypto was stolen. The company went into liquidation a few months later. In 2020 the High Court ruled that the crypto Cryptopia held belonged to its customers, on trust. Even so, customers waited years: the first distributions didn’t begin until 2024.

Internationally, the 2022 collapse of FTX showed a different risk. Its terms said customer assets belonged to customers, yet billions of dollars were misused and withdrawals stopped overnight.

New Zealand’s Depositor Compensation Scheme protects money held with licensed banks and other deposit takers. It doesn’t cover crypto held on an exchange, here or overseas. If an exchange is hacked or fails, there is no government backstop.

Why this is the case for self-custody

When you leave crypto on an exchange, you don’t hold the crypto. You hold an account balance: a promise from the exchange that it will hand the crypto over when you ask. That promise is only as good as the exchange’s security, solvency and willingness to pay.

With a self-custody wallet, you hold the private keys yourself. Your crypto sits on the blockchain under your control, not in a pool with millions of other customers’ funds. A breach at an exchange can’t freeze your withdrawals, because there is nothing to withdraw: it’s already yours.

It also changes what attackers can win. An exchange hot wallet is a single target worth billions, which is exactly why well-funded state hackers spend days preparing for one. An individual’s wallet is a much smaller prize, and there’s no single breach that drains everyone at once.

This is the reason Flow is built the way it is. Flow doesn’t provide a hosted wallet: crypto you buy through Flow is sent to the external wallet address you supply. We never hold a balance of your crypto for you, so there is no Flow hot wallet of customer funds to empty.

Self-custody isn’t risk-free

Holding your own keys moves the responsibility to you, and it’s worth being honest about that. If you lose both your device and your recovery phrase, nobody can restore access: not a wallet company, not an exchange, not Flow.

Scammers know this too. Nobody legitimate will ever ask for your seed phrase or private key, and anyone who does is trying to steal from you. Hardware wallets reduce exposure to malware, but they aren’t immune: buy one only from the manufacturer or an authorised seller, set it up yourself, and never use a recovery phrase that arrives in the box.

What to do now

If you have crypto on any exchange, ask how much of it you actually need there. A sensible approach is to keep only what you are actively trading on an exchange and move longer-term holdings to a wallet you control.

Before you move anything, set up the wallet, write your recovery phrase down on paper and store it somewhere safe and offline. Send a small test amount first, check it arrives on the right network, then send the rest.

Binance customers should withdraw only through the official app or website, and ignore emails, texts or social media accounts offering “refunds” or “recovery” help. Big hacks are always followed by scammers posing as support staff.

This article is general information only and is not financial advice. Crypto-assets can be volatile, and blockchain transfers are generally irreversible.

Eli Hylands

Eli is the founder of Flow Crypto and editor of Flow News, covering crypto for New Zealanders.