After the Binance hack, Europe should tighten crypto custody rules under MiCA

Binance, the world's largest crypto exchange, suspended all withdrawals after an attack it estimates affected about $6.3 billion in assets. According to Binance, an initial investigation pointed to a compromised engineer's laptop, and on 30 October the company said it had found additional points of breach. Blockchain intelligence firm TRM Labs linked the attack to TraderTraitor, a North Korean unit, and called it the largest crypto theft on record.

About $3 billion, mostly stablecoins, has been frozen, Binance said. Tether froze about $1.5 billion of USDT and Circle froze $800 million of USDC. Elliptic said the attacker had moved roughly $3.3 billion into assets that cannot be frozen, such as ETH. Binance said it has set aside over $6.34 billion of company funds to cover the losses and found no evidence that private keys were breached. Co-chief executive Yi He said withdrawals should resume within 48 hours.

A state-level target

The numbers keep climbing. North Korean hackers took $1.5 billion from Bybit last year. According to Chainalysis, they stole about $2 billion in crypto in 2025, a 50 percent rise on the year before. Bitget lost nearly $390 million last month. Peter Ward of the Sejong Institute in Seoul said North Korea gives its hackers near-total protection and warned that things may get worse.

In our view this changes the threat model. A large exchange is no longer defending against opportunists. It is defending against a state with time, money and no fear of arrest. And if Binance's first account is right, a single laptop was enough to open the door.

What protected customers this time

Two things stood between Binance customers and real losses. The first is Binance's own balance sheet. The exchange holds about $140 billion of digital assets, and Changpeng Zhao has said its annual revenue is about $5 billion. Zhao said a gap of roughly $2 billion remained and pointed to SpaceX shares worth more than $1 billion. The second is the freezing done by Tether and Circle.

Both are acts of discretion, not obligations. A smaller exchange would not have billions to spare. Assets moved into ETH could not be frozen at all. Customers were protected by size and goodwill, not by rules.

The European angle

Binance was ordered to wind down its EU operations in July after failing to secure a licence under the bloc's new crypto framework, MiCA. That shows the licence regime has teeth. But a licence decides who may operate. It does not on its own make a platform hard to rob, and exchanges licensed in Europe face the same attackers.

Some institutional investors already keep assets with third parties rather than on the exchange. Binance itself works with the Swiss banks Sygnum and Flow, according to the FT. Ordinary savers rarely have that choice.

One objection is that stricter rules raise costs and push users towards unregulated offshore venues. That risk is real. We think it argues for making licensed venues visibly safer, so that savers have a concrete reason to stay inside the system.

Still uncertain: how the attackers got past further defences, how much of the unfrozen $3.3 billion will be cashed out, and whether withdrawals restart as promised. Watch how Abu Dhabi's regulator, which said it is engaging closely with Binance, responds.

Our view

We think European supervisors should use MiCA to set firm demands on custody. That means keeping most customer assets in segregated cold storage, publishing regular independently checked proof of reserves, and holding a funded loss buffer sized to a realistic worst-case hack. Exchanges serving Europe should be able to show, not just promise, that a stolen laptop cannot empty them. Acting now is cheaper than acting after Swedish and European savers become the next source of funds for North Korea.