What the biggest crypto theft in history means for investors
Hackers have stolen approximately $6.3 billion worth of cryptocurrencies from the Binance cryptocurrency exchange. Binance has promised to cover all losses. Dr. Marco Rogert of Rogert & Ulbrich warns in FOCUS that this promise is not deposit protection. We explain what customers can rely on and what those affected should do now.
What happened at Binance
The Attack on Binance It is considered the biggest cryptocurrency theft in history. FOCUS online We reported on this in detail on October 30, 2026, and interviewed Dr. Marco Rogert. Here's an overview of the key facts:
- Time: The attack began on the evening of October 29, 2026. Within approximately 20 minutes, crypto assets flowed out of the exchange's wallets.
- Damage: Blockchain analysts at TRM Labs estimate the loot at around $6.36 billion. That's roughly four times the previous record set in the attack on the Bybit exchange in February 2025.
- Gateway: According to initial reports from Binance, an IT employee's laptop may have been compromised. The perpetrators are believed to have gained access to the systems Binance uses to authorize withdrawals.
- Scope: The perpetrators accessed ten blockchain networks simultaneously, including Bitcoin, Ethereum and Solana.
- Perpetrator: TRM Labs attributes the attack to the hacking group TraderTraitor, which is believed to be linked to North Korea. The FBI had previously held the same group responsible for the Bybit hack.
- Frozen values: Stablecoin issuers such as Tether and Circle, along with other companies, locked up approximately $2.7 billion, according to an initial assessment.
- Binance's commitment: Co-founder Yi He announced that all losses from the attack would be covered.
The Bitcoin price temporarily fell to around $76,500 after the attack. Other cryptocurrencies and shares of crypto companies also came under pressure.
Do you have funds on Binance or another cryptocurrency exchange and are unsure how well they are protected? Have your situation legally assessed.
Whoever controls the key controls the money
Bitcoin itself was not compromised in the attack. No one manipulated the blockchain. The stolen coins are technically just as valid as all the others. The vulnerability lay elsewhere: in the custody of the coins.
Cryptocurrencies are not stored in a vault. They exist as entries in a public database, the blockchain. Anyone who possesses the corresponding private key can transfer the coins to another address. The blockchain only verifies whether a transfer is validly signed. The signer does not verify it.
That's exactly what the perpetrators exploited. To the blockchain, their payouts looked like regular transactions. The technology worked correctly, but to the benefit of the wrong recipients.
For investors, therefore, it is crucial who holds the keys:
- Balances on a stock exchange: The exchange holds the keys. Customers do not have direct access to specific coins, but rather a contractual claim against the exchange.
- Own wallet: Those who hold their crypto assets in their own wallet control the keys themselves. A hack of an exchange does not affect these assets.
- Personal responsibility: With your own wallet, you bear full responsibility for your login credentials and recovery phrase (seed phrase). If it gets lost or falls into the wrong hands, no exchange can help.
Are large holdings permanently located on a single exchange? Check what rights you actually have in an emergency.
Why Binance's promise is not deposit protection
Binance has announced it will fully compensate for the losses resulting from the attack. According to the exchange, it has already begun compensating affected users. This is initially good news for customers.
Dr. Marco Rogert offers a sober assessment of the commitment to FOCUS online: "Binance's commitment is a promise, not a deposit guarantee." Therefore, those affected should not rely solely on it.
The difference is important. Bank deposits in the EU are covered by statutory deposit insurance up to €100,000 per customer and bank. This applies regardless of whether the bank is willing or able to pay out. There is no comparable statutory protection for balances held on cryptocurrency exchanges.
Binance's commitment therefore depends on the company's solvency and willingness to cooperate. According to the FOCUS report, the exchange's security fund recently stood at around one billion dollars. Even after freezing a portion of the loot, the damage remains in the billions and would have to be covered from other sources.
Furthermore, there is the question of supervision. In the EU, the MiCA regulation obliges authorized crypto service providers to safeguard the assets of their clients. to keep them separate from one's own assets. According to media reports, Binance does not yet have MiCA authorization in the EU. Whether and how an exchange will be established remains to be seen. after a hack, therefore it also depends on which company the contract is with and which terms of use apply.
Don't rely solely on stock exchange announcements. Record your account balances now, while all the data is available.
Blockchain never forgets: How stolen assets are tracked.
Ironically, key authorities managed to salvage some of the loot. Stablecoins are digital currencies whose value is pegged to the US dollar. Their issuers can block specific addresses. According to TRM Labs, Tether blocked approximately $1.77 billion, and Circle another $825 million.
With Bitcoin and Ether, it's more difficult. There's no central authority that can stop a transfer. Initial analysis indicates that the perpetrators hold, among other things, more than 18,000 Bitcoins and hundreds of thousands of Ethers. However, these assets are not untraceable.
Crypto forensics expert David Lüdtke, also quoted in the FOCUS report, points out that every transaction on the blockchain remains publicly viewable. Perpetrators attempt to conceal their loot using mixers, bridges between different blockchains, and traders outside of exchanges. However, when exchanging the funds into euros or dollars, the route usually leads through exchanges, which are required to identify their customers.
For victims, this is the crucial starting point. Blockchain analysis It makes the path of the funds traceable step by step. If stolen assets end up on a regulated exchange or stablecoin issuer, it may be possible to have them blocked.
Have your crypto assets been stolen? Secure the evidence while the funds can still be frozen.
What victims should do now
According to Dr. Marco Rogert, those affected significantly improve their position if they take action themselves. This applies to Binance customers as well as to anyone who has lost crypto assets in a hack or fraud:
- Document account balances: Save your balances, account statements, and transaction histories as screenshots and exports. In case of a dispute, these are the most important evidence.
- Secure communication: Keep all emails, chat histories and communications from the stock exchange, including announcements regarding compensation.
- File a criminal complaint: In case of theft or fraud, you should file a police report. The case number will help with any later inquiries.
- Track transactions: A forensic report shows where the coins flowed and which exchanges they ended up on.
- Have accounts blocked: Such an expert opinion can be used to initiate the blocking of accounts at stock exchanges where parts of the loot end up.
- Information and claims: On this basis, information about the account holders can be requested and claims against the recipients can be enforced.
If a payout remains blocked for a longer period, the following principles apply: refused payouts by cryptocurrency exchangesRequest information about the reasons, set a reasonable deadline, and document every step. Whether a temporary suspension gives rise to any claims depends on the exchange's terms of service and the individual case.
Have you lost cryptocurrency in a hack or scam? Secure all your evidence now and have your case reviewed to determine what steps are possible.
Beware of fake helpers after the hack
Major attacks attract copycats. Dr. Marco Rogert warns in FOCUS: After every major hack, fraudsters impersonate Binance support, investigators, or so-called recovery companies. They promise to recover lost crypto assets in exchange for upfront payment.
Typical warning signs are:
- Unsolicited contact: Someone contacts you by phone, email or social media and offers help in connection with the Binance hack.
- Prepayment: They are asked to pay a fee before the alleged repatriation begins.
- Questions about access data: According to Dr. Marco Rogert, reputable help never asks for login details or the recovery phrase of a wallet.
- Transfer to a new wallet: You are instructed to transfer your coins to a supposedly protected address for security purposes.
- Guarantees: Anyone who promises to safely recover stolen crypto assets is promising something that no one can seriously promise.
- Time pressure: You are told to act immediately because your assets are allegedly at risk.
Get your information exclusively from the stock exchange's official channels. Anyone who has already fallen victim to such a scam should contact the authorities. Online fraud Anyone who has fallen victim to this scam should refrain from making any further payments, inform their bank, and file a police report.
Have you been contacted by a supposed recovery company or have you already made a payment? Do not pay anything further and seek advice immediately.
Rogert & Ulbrich – Your lawyers for crypto fraud and problems with crypto exchanges
Rogert & Ulbrich represents investors and consumers in banking and capital market law and at Crypto fraud. The partners Dr. Marco Rogert and Tobias Ulbrich They have extensive experience with disputes against cryptocurrency exchanges, payment service providers, and banks. Dr. Marco Rogert is a specialist lawyer for banking and capital markets law.
We investigate whether you have claims against an exchange or against the recipients of stolen assets. We initiate account freezes, request information about account holders, and enforce your rights out of court and in court. We collaborate with blockchain forensics specialists to trace transactions.
Have your crypto assets been stolen or is your exchange not paying out? Take contact and secure your claims.
