Isn't Binance the one that needs to be prosecuted for negligent security? How does "a compromised laptop" lead to a $6bn wipe in a matter of minutes?
This is why banks are regulated, though I have no idea if/whether these platforms are regulated in any similar way.
To unlock my laptop - I need a boot password - then I need a finger print scan - after that a password, after that a 2fa app. Then I need to connect to a VPN .. 2fa again. My laptop locks within 1 minute of inactivity. 30% of my CPU and RAM get hogged by our security suit constantly. My USB ports are disabled for data. I understand it's windows and windows can get compromised - it's just very unlikely that it gets compromised to a level where you could actually cause damage.
They can even block all but allow-list certain vendors and models, but because USB is an unauthenticated standard - an attacker can easily spoof any vendor or model. So best not to rely on that and instead block all of certain types of USB device.
No ones going to disable mice/keyboards.
If the point was to eliminate all possible ways of compromising the device, they'd just put the device in the shredder.
You have to balance having a usable and functional thing with the risks involved.
FYI each of the top 10 banks in the US have been hacked before, and they’re still doing ok.
Ah yes, the bane of enterprise workplaces.
I'd be surprised if it were. Crypto exchanges have been targeted by hackers since forever, and Binance is one of the top. If it was so easy to exfiltrate crypto from them, I'd have expected a heist before now. (Unless controls have just gotten worse recently.)
Just going from what Binance PR must believe about a laptop it seems unlikely to me that they've been tested in much depth by anyone with mafia tactics.
> Binance has said the incident was a “complex attack” that stemmed from multiple factors.
> Its initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorised withdrawal transactions.
I know it says "multiple factors" here, but there are no other factors I've found.
> Our initial investigation suggested that the security incident may have involved a compromised laptop, however our subsequent investigation has uncovered additional points of breach.
That seems to be their most recent update on the matter afaik (30 Oct, 8:47am UTC)
Of course they want it to sound like the world’s most sophisticated hacker
The FBI and other federal agencies engaged in law enforcement routinely use appeals to authority and expertise they do not have and create set-piece situations that almost in every case involving more than one defendant sets up a circular firing squad situation where the most guilty is at an advantage of simply pleading guilty and cooperating first, or otherwise they'd dump it off via the AUSA down to the state level if they can, or blame China, Russia, NK, Iran, or Israel, countries that do not extradite their own citizens on request and rarely if ever do so unless it's done so on their terms. Blockchain tracing ultimately still needs the connection between the chain and off-chain ID and there's no surefire way to even ascertain with something that isn't a mere heuristic with an error rate unacceptable in criminal court and would fall apart if there's competent defense counsel, which the FBI have, in the one case where on-chain evidence was going to be used, actually went full Chewbacca and created a two year delay mid-trial and then pulled Chainanlysis' "expert" off before cross examination. The company has the balls to brag as if the courts have validated their method in whole, when in reality the court have long understood what clustering is and so that part is of course admissible evidence, but it also doesn't get you to the purported end - attribution. If one can use a strawman as a sales tactic, this would be exactly that. The attribution aspect have never been allowed to be properly examined in the criminal context. The "reactor" is merely a database, and in the small bit of direct examination the chainalysis employee claimed that every time he queried the database the correct rate was some absurd, Robert-Mugabe's-election-number figure that is higher than the DOJ's conviction rate when they were still credible and actually higher than the CCP's official conviction rate in a fake criminal justice system where due proceess doesn't exist and they give leeway because claiming to be 99% correct is absurd. Of course, they've never been tested in the same situation and still haven't, and if the industry mouthpiece is basically hiring sales and not legal, which is basically what every company in the Blockchain Association has been doing, rent-seeking to be Wall Street 2.0 on top of free merged pull requests and open source software. Tracing on chain is all well and good for shits and giggles but Department of Treasury went and sanctioned a smart contract thinking that it was an EOA address that belongs to a person as if etherscan was never checked beforehand tells you all you need to know.
They had a bad case against Tornado Cash since the ultimate demand would require the devs to somehow predict the actual identities of those that interact with their contracts - which in many cases isn't even a human. It's telling that when the 5th Circuit and the one judge in that circuit who knows anything about process and technology through sheer luck got on the panel and wrote a clear rebuke of how federal investigators failed at doing any due diligence, and for once, the feds did not attempt to do an end-run or even ask for en banc hearing of the issue, but simply made up a completely different issue to pursue (building the front end) which is not a crime. The feds can't match the IP/in house firms in renumeration and can't even match public interest or federal defenders in hiring out of tech competent law grads when it comes to having a moral high ground. They have so much resources so that they can hire contractors, but can't vet the contractors. Being able to fall back on coercion covers up a lot of incompetence. The Atomic Wallet 'hack' was almost certainly not a NK job as they have claimed, for example, and they relied on some dude on twitter's hunch (notably the first thing one learns that is never evidence if presented in court) and a post-hoc heuristic that is indistinguishable from a copycat or a third party's infrastructure to make the attribution. People with poorly thought out opinions are all over the place on Twitter, but this permission slip to "make mistakes". Also, they're part of the system of funding provided to your local police so they are better funded now than before 2020. Check their work under all circumstances, and plea bargains should not be considered as evidence of actual guilt since coercion and BS is as common as actual cases backed by properly collected evidence that builds a procedurally sound case.
FWIW in 2022 one of their systems was breached and $570 million worth of "BNB" was taken.
Note that “crime” has a specific definition in law. You don’t have to be a criminal (commit a crime) to be rightfully sued, civil suits are a thing.
Anyway, your parent comment already answered the question, they would be sued by negligence.
Only the government (e.g., federal, state, local) may bring a criminal suit.[1] But in both civil / criminal cases they are still a suit under the law seeking some form of ordered relief from the Court.
Essentially, you can think of "criminal" as a category of law and relief (e.g., prison) that is only accessible to the government.
Both the government and citizens may bring "civil" suits. Very generally, the remedies in civil suits are a court order to 1) stop doing a thing; 2) to do a thing required by law / agreement; 3) to transfer property, usually but not always money, from one party to another; or 4) to define a set of rules governing the parties going forward.
[1] There may be some obscure exception to this, but it is true for everything I've ever seen / heard of.
> If they do not have the liquidity to let people withdraw money that is another issue, but it does not seem to be the case.
Again they cannot be charged for losing billions of their own money, and there is no way to somehow consider the lost funds as "customers' money". I am all for companies getting sued due to negligence when eg they fail to protect customer data, but this is just between binance and the hackers.
So this stolen crypto is off Binance own reserves. So it could be absorbed across current accounts as long as they aren’t drawn down to below $6B? And if crypto drops they can apply cash reserves to plug the hole more easily?
Next time this happens to Binance though they won't have an emergency fund and possibly they'll be in debt, and that's when the users will be very screwed.
Their terrible security certainly indicates to me that future of Binance is not going to be a pretty one unless they make some enormous changes.
It seems very unlikely they have $3-6B lying around ready to repay customer deposits. At the very least this would be catastrophic for them if they do lose all that money.
Have they re-enabled withdrawals yet? If I were a customer I'd be taking everything out as soon as possible.
For Binance? I’d actually say very likely. They’d need to move a couple of papers around, but should be easy.
withdrawals have been paused since Thursday night. binance says it will reopen them in stages from Sunday and publish proof of reserves by Monday, which is the thing that would actually answer your question.
Funds have been already allocated for recovery by the CEO Richard Teng.
$3.5B stolen was "stable coins", which you could equate to a piece of paper with a dollar amount written on it.
Those are largely freezable by the issuer of the paper.
Then we have $2.4B in Bitcoin and ETH stolen. Those are not directly freezable.
However, if that does create a liquidity challenge for these exchanges, what if the price just so happens to drop by 60% after trading is restricted? That liability might shrink in actual value.
Comparing crypto to actual currency typically connected to large, real economies is not relevant here.
A country like Iceland is far smaller, and their currency famously fluctuated in 2008. Would you consider Icelandic króna as money? Most people do.
Anyway, that and your question are hardly relevant to the fact that Binance and their cabal own the crypto exchanges and consequently could manipulate the price to reduce the size of their obligation denominated in crypto rather than currency or stable coins.
I understand Binance alone accounts for a third of the market, and their ability to coordinate with other exchanges is hardly restricted to the participants we know were in that specific group chat.
I think the point stands that a liability in eg. USD is much different from one denominated in crypto.
Yeah Binance itself is big but it'll take a lot more than one exchange, an exchange everyone is now handling with extra suspicion, to cause a crash.
> I think the point stands that a liability in eg. USD is much different from one denominated in crypto.
If course it's different but that's so much weaker of a point. And the foreign currency comparisons weren't to particularly stable currencies.
> "Those are largely freezable by the issuer of the paper."
Interested to understand how this would work in a decentralised accounting mechanism.
So there are good reasons to be skeptical of his statements.
Binance and its former CEO, Changpeng Zhao, were previously sued for willfully evading anti-money laundering (AML) controls. In that instance, the government ruled their compliance failures were not an accident, but a deliberate criminal enterprise. Binance paid $4.3 billion in fines and forfeitures to settle with the DOJ, CFTC, and FinCEN in November 2023.
No, it's not. At least not historically.
Sorry, what do you mean?
Basically, the historical origins of different bank regulations are quite complicated and also differ from place to place, and they were often put in place by (political) coalitions of people who already had not one single motivation but a whole spectrum of them.
And then in addition to historical reasons, you also need to ask why things are still in place. Inertia is one answer, but it's not the only one.
Sorry, what do you mean?
-- think that's referring to bank deposit insurance schemes...
US banks tend to meet AT1 requirements by issuing preferred shares.
Binance's approach seems to be based on vibes and a vague promise
To understand the regulatory framework for banks, the best place to start is the BIS and Basel III. https://www.bis.org/committees/bcbs/standards Generally speaking, international banks follow Basel III in addition to their domestic regulators’ capital requirements (which are probably also derived from Basel III, but have differences just to make things tedious).
However, BIS and Basel III (and the previous Basels) are just what's currently in force for most of the world. I suspect most people would be better served by more of an historical overview. But it also depends on what one is interested in.
Do tell me, please: why do banks care about getting deposits? And why did Silicon Valley Bank get into trouble, when depositors left?
Makes me think traditional banks have solved this from the start. You can't steal the backing of an unbacked currency.
Traditional banks and crypto exchanges alike rely on the carefully cultivated illusion that you can withdraw your money at any time.
$6B is probably several billion too large for a hot wallet but it's not completely obscene for an operation of Binance's size.
When everything goes wrong the only defense is to be slow enough to fix it.
This idea that there are shortcuts that you can be decentralised and fast at any size is wrong.
I would assume binance is more like a bad bank but without the internal friction to make stuff like this hard.
But you’re absolutely right, it’s hard to compromise something that moves at such an absolutely glacial pace.
Yes. Move fast and break things and forget governance... Cryptocurrency has always been dumb. You either con people out of their money or you lose yours.
I had someone approach me in 2017 or so because he wanted to do a rugpull coin operation. I said I was busy and didn't help, but I'd probably be much richer (and a piece of shit human) if I got involved.
Regulations probably help but they basically serve to keep evolutionary memory in place in a corporate ecosystem where companies can spawn from nothing.
Bad banks no longer exist but regulations, after an extinction event, perhaps try to make that evolutionary event permanent.
At least that is my mental model.
Regulations are very lagging. And they should be understood to create moats and friction. There is no free lunch. Regulations purposefully shrink or destroy markets. That is how markets work.
Something I wish tech folks would absorb more.
If it's not frustrating and stupid, (to you at the time) it's probably not really a regulation.
This is a funny take on things, and untrue. But traditional finance is way safer and better controlled than the crypto frontier. Someone like coffeezilla has to rely on patreon and ad revenue to do the sort of journalism that exposes how debased cryptocurrency finance is. There should be much more money in exposing the fraud, but our premier capitalists are complicit in the fraud. They are fraudsters at heart, which is why they have the money and influence they do.
> Regulations purposefully shrink or destroy markets.
Sometimes maybe, but that's a matter of corruption. Regulatory capture has been used to create regulation that protects monopolies, duopolies, and the broader oligarchy for a very long time. When politicians were representatives of their voters, things worked better. Post-citizens united, the incentives are broken and we have a congress full of duplicitous, self-interested idiots.
What happens when the US govt tells others not to do business with you?
I wonder what could happen if somebody compromised Jamie Dimon's laptop?
Best a hacker could probably achieve is sending some sketchy emails or messages, but even there people are just going to confirm by verbally communicating with him.
Banks are actually the worst analogy for this sort of thing because there is a ridiculous amount of system federation and ultra-conservative system controls. It can take a month to get a simple route or firewall port opened on controlled networks (god I hate change committees).
I am not sure why this get thrown randomly as the solution to every problem. Bitfinex major hack was due to regulation. Banks and Crypto companies don't have the same attack surface and the one for crypto is way more complex due to permissionlessness.
Last I heard he’s is now living in luxury in the United Arab Emirates. There was a profile on him in a paper.
I’m not sure Sam has enough cash to get a pardon.
“Mr. (Changpeng) Zhao has a long history of legal and regulatory problems. Binance pleaded guilty to money-laundering violations in 2023 and paid a $4.3 billion fine to the U.S. government. After serving a four-month prison sentence, Mr. Zhao was pardoned by Mr. Trump last year. Binance also forged a business relationship with World Liberty Financial, the Trump family’s crypto company.” [1]
[1]
https://www.nytimes.com/2026/10/30/technology/binance-hack-a...
[2] https://www.nytimes.com/2025/10/23/technology/trump-pardons-...
I can't imagine thinking that banks won't lose your money. You live in a complete fantasy world.
If you live in Argentina, I sympathize and I take your point.
People who essentially want government guarantees for their money should just buy government bonds.
Not with simple account deposits, no
Basel rules are still a thing
Customers stop monitoring their bank, when deposits are insured.
>The general assumption is that it would require the US government to collapse for your checking account to vanish, in which case you'd probably have larger problems to worry about.
See USSR-Russia transition in 1990-1992 for example.
Accounts didn't vanish, but all people's money where used to cover the deficit
Crypto 'banks' need orders of magnitude more security and it's not a trivial problem.
Bank don't loose USD because it can printed at will the the holding country like they bailed banks in 2008.
My grandfather lost his tuition money he had saved to become a dentist, in the great depression.
Instead he worked his whole life in a factory for GE.
Yep... that's why banks have never been robbed, never been hacked, and neer lost money! ;)
Wasn't it even a central bank that was hacked into a couple of months ago?
Thank god for regulation!