Mentioned in This Article
1. Why a crypto exchange hack can be harder to stop than a bank theft
An attacker who takes over an exchange's withdrawal controls can move billions of dollars in minutes, and the money may never come back. That risk is in focus after the theft of about $6.3 billion from Binance on Thursday, October 29, the largest crypto exchange hack reported to date and the trigger for a debate about exchanges and banks.
The attack did not defeat the cryptography that underpins Ethereum (ETH). Investigators and analysts describe it as a failure of the permissions and operational controls used to run a wallet, which is a different kind of weakness from a flaw in the blockchain itself.
The distinction shapes the debate. If the problem were the technology, the solution would lie in redesigning protocols. Because the problem lies in how organizations manage keys, devices and approvals, the comparison with banks becomes relevant, since banks have spent decades building procedures for exactly those matters.
2. Are banks hacked as often as crypto exchanges?
Banks are also attacked regularly. A 2024 report from the International Monetary Fund found that banks were the most frequent targets of cyberattacks in the financial sector. Financial firms accounted for nearly 20% of reported cyber incidents across all industries, with almost $12 billion in reported direct losses between 2004 and 2023.
Those numbers have limits. They measure reported cyber losses, not every dollar lost to bank fraud, and they cannot show whether banks or crypto exchanges are hacked more often. Nobody quoted in the discussion offered comparative data that would settle the question.
What the figures do establish is that the financial system as a whole is a persistent target. The argument is therefore not about whether banks are immune, but about what happens after a breach.
Put simply, the argument is not over whether either type of institution can be breached. It is over how many layers of defense stand between a breach and a loss, and whether any of those layers can be reversed once money has moved.
3. What attackers gain once they are inside
Tomer Sharoni, chief executive of the Israeli blockchain intelligence firm Addressable, argues that the difference lies in what an attacker can take, not in how the attacker gets in. In his view, a bank employee's laptop can be compromised in the same ways as an exchange employee's, through phishing, malicious downloads or fake job interviews. The difference is what waits at the end of the intrusion.
Banks, he notes, give themselves several chances to stop a fraudulent transfer. Compliance checks and reviews by the banks that process payments can catch suspicious activity, and some transfers can be recalled after the fact. A confirmed crypto transaction, by contrast, generally cannot be reversed, although issuers can freeze some stolen tokens.
Sharoni says the speed, finality and irreversibility of crypto make large treasuries among the most valuable targets in finance. He adds that crypto firms are attacked more often because the rewards for hackers are greater.
That framing shifts attention from the entry point to the aftermath. Phishing and malicious downloads work on staff at any organization, so the question becomes what an organization can do in the minutes and hours after an employee's device has been compromised.
4. Is crypto really hacked more, or just more visible?
Abdul Rafay Gadit, co-founder of ZIG Finance, disagrees with that conclusion. He argues that crypto does not get hacked more than banks; it simply cannot hide breaches or undo them.
Gadit says banks are breached constantly but handle most incidents quietly, often disclosing them later or not at all. Crypto thefts, on the other hand, appear on block explorers within minutes, which can make them seem more frequent. Banks tend to investigate internally and notify customers privately, whereas anyone can follow stolen crypto on a public blockchain.
He also points out that a bank breach does not necessarily involve stolen money. Attackers may take customer records or passwords without touching deposits. The two experts therefore diverge on whether crypto firms are attacked more or merely have more visible losses, and neither supplied data to prove the point.
The disagreement is partly about perception. If one industry discloses its breaches publicly and by default, and the other discloses them selectively, then a simple count of reported incidents will make the first look worse even if the underlying rates are similar.
5. How did the Binance attack work?
Attackers drained about $2.5 billion from a Binance wallet in under four minutes, according to an examination of the incident. Malicious code was authorized to operate the wallet through EIP-7702, an Ethereum feature that lets ordinary wallets run smart contract software.
Binance co-CEO Richard Teng said on Friday that investigators had found multiple breaches, including evidence that the attackers used a mechanism to erase traces of their activity. The exchange is rebuilding its withdrawal infrastructure and reviewing its signing procedures, employee devices and key management.
The attack exploited the systems and permissions used to run a wallet rather than the underlying cryptography. That is the point on which both sides of the bank comparison largely agree, even as they differ on its implications.
The speed of the drain, about $2.5 billion in under four minutes, is the detail that most separates the incident from the kind of fraud a bank's review process is built to catch.
6. What safeguards could limit the damage?
Gadit says exchanges need the operational safeguards that banks have developed over time: separate signing authorities, approval procedures and withdrawal limits. Such measures are designed so that no single compromised device or person can authorize a large transfer on their own.
In his words, crypto is not more vulnerable than banks, just less forgiving. A control failure at a bank can often be corrected after the fact through recalls or reversals, while the same failure in crypto can be final the moment a transaction is confirmed.
The $2.5 billion drained in under four minutes shows why speed matters. Controls that depend on a human reviewing a transfer after the event offer little protection when the funds can be gone before anyone intervenes, which is why limits and approvals need to operate before a transaction is signed.
Many of these controls are unglamorous. They add friction, require more than one person or system to agree, and cap how much can leave in a given period. Their value shows up only on the day an intrusion occurs, when they can turn a catastrophic event into a limited one.
7. A pattern of large losses
The Binance theft is not an isolated case. Before it, CertiK recorded $1.28 billion in crypto losses in the third quarter of 2026, up nearly 56% from the previous quarter. The $1.5 billion theft from Bybit in February 2025 was another attack on the systems that control digital assets.
Daniel Tunkel, head of financial regulation at the London law firm Edwin Coe, calls exchange security risks an accident waiting to happen. He says regulators should assess whether exchanges have the financial resources and safeguards to survive a major breach, rather than focusing only on prevention.
His point reflects a tension in how exchanges operate. They must protect large reserves while keeping enough funds available to meet trading demand and customer withdrawals, and the more funds are kept readily accessible, the more there is to lose in an attack.
The figures from CertiK and the earlier Bybit case place the Binance theft within a pattern of rising losses, in which the largest incidents increasingly involve the systems that control assets rather than flaws in individual protocols.
8. Can blockchain tracing close the gap?
Sharoni says the transparency of blockchains helps investigators follow stolen funds, but tracing a theft is not the same as preventing it. Following money across wallets can support freezes and investigations, yet it does not guarantee that the assets will be recovered.
He describes closing the gap between detection and prevention as the industry's central security challenge. Detection tools are improving, but the Binance case shows that large sums can leave a platform far faster than any response can be organized.
For exchanges, that means the priority is to stop an attacker earlier in the chain, at the point where keys, devices and approvals are managed.
There is also a practical limit on tracing. Identifying where stolen funds went can help exchanges and issuers freeze assets that sit on cooperative platforms or in tokens with freezing features, but assets that have already been moved on or converted can be much harder to catch.
9. What to watch next
Binance's review of its signing procedures, employee devices and key management is the most immediate development, along with the rebuilding of its withdrawal infrastructure. Further findings from investigators about how the attackers gained access and covered their tracks may also emerge.
Beyond Binance, attention is likely to turn to whether exchanges adopt separate signing authorities and withdrawal limits more widely, and whether regulators follow the suggestion to examine the financial strength of exchanges as well as their defenses. The debate over crypto versus banks is unlikely to be resolved without comparable data, but the Binance case has made the operational questions harder to ignore.
Investigators and exchanges will therefore keep working on both sides of the problem, improving the tools that follow stolen funds while tightening the controls that keep them from leaving. Neither effort alone is considered sufficient.