Crypto’s biggest heist has a middleman problem

Halloween horrors came early for crypto investors. At around 4pm ET Thursday, money started disappearing from Binance. In roughly 20 minutes, hackers siphoned about $6.3 billion from the world’s largest crypto exchange, making for what appears to be the biggest crypto heist of all time.

The blockchain itself wasn’t broken. Attackers instead compromised infrastructure Binance uses to approve withdrawals, letting unauthorized transfers look legitimate. Binance froze withdrawals and said in a post on X that customers would be made whole.

But the market got spooked anyway. Bitcoin fell to a six-week low, ether hit its lowest level in two months, and Coinbase, Strategy, and Robinhood also slid.

Even digital money can still produce a very analog panic. And for an industry built around not having to trust a middleman, that’s not the way you’d expect to lose billions.

Trustless, with terms and conditions

Blockchains were designed to let people own and move assets without relying on a bank or broker. In practice, most investors would rather not spend Saturday guarding a seed phrase like it’s the nuclear codes, so they use exchanges instead.

But that convenience brings the middleman back. Your crypto may live on a decentralized network, but somebody still has to keep the keys safe, approve withdrawals, and make sure the platform itself doesn’t become the weak link.

Recent hacks show why that matters. Attackers stole $1.5 billion from Bybit last year in a heist the FBI linked to North Korea, while Polymarket briefly halted trading this week after a third-party security provider was compromised.

The attackers are also getting more sophisticated. OpenAI recently disclosed that research agents testing cybersecurity capabilities found exposed credentials and access tokens, using them to gain deeper system access. When billions can move in seconds, one bad credential can become a very expensive shortcut.

The vault is part of the valuation

That matters as more institutional money moves into crypto.

EY data from this year finds that 73% of institutional investors planned to increase their digital-asset allocations, while most investors with direct crypto exposure preferred regulated vehicles over holding the coins themselves.

Professional investors increasingly want regulated custodians, insurance, and a clear answer about who pays if something disappears. That’s now helping drive demand for crypto-specific insurance that can cover anything from stolen keys to wallet breaches and custody failures.

The bigger takeaway: Security is starting to look less like a cost center and more like a competitive moat. Exchanges that can prove they have stronger custody, deeper reserves, and better loss protection may have an easier time winning institutional money. A major breach can do the opposite by draining capital, raising insurance and compliance costs, and making customers think twice about where they park their assets.

For crypto this Halloween, the scary part isn’t the trick. It’s figuring out who you trust with the treat.—HC