On October 29, 2026, Binance was hit by a cyberattack involving unauthorized transfers of approximately US$6.34 billion in crypto assets from its hot wallets. In its November 3 update, Binance reported that approximately US$2.85 billion in assets had been frozen or intercepted. These figures remain subject to reconciliation, and the investigation is ongoing.
The incident also raises practical questions about how crypto platforms manage custody, approve withdrawals, and protect client assets.
Here's what we know so far, and why it matters in Canada.
Binance's November 3 preliminary report describes a multi-stage attack spanning several months. According to Binance, attackers targeted employees through a tampered software download and a fraudulent job interview involving malicious code. They then used compromised devices, stolen credentials, and an internal AI tool to reach systems involved in wallet operations.
On October 29, the attackers used that access to reach an internal wallet-signing service, which authorizes crypto transactions. Binance previously said it found no evidence that wallet private keys were leaked. Its findings remain preliminary, and the company plans an independent cybersecurity review.
Blockchain analytics firms TRM Labs and Chainalysis linked the attack to North Korea's TraderTraitor group. The FBI publicly attributed the theft to the same group on October 31.
Binance says it will absorb the losses from the theft rather than pass them on to users. In its November 3 update, the company reported that 98% of the affected token assets had been replenished as of October 31. Binance began restoring withdrawals in phases on November 1, while deposits remained operational throughout.
Freezing stolen assets can prevent further transfers, but it doesn't mean those assets have been recovered. Binance's efforts to replenish customer balances are separate from its work to trace and recover the stolen funds.
A private key is the secret information used to authorize a crypto transaction. Protecting it is essential, but it’s only one part of a platform’s security.
A trading platform also needs systems that decide when a withdrawal can happen and who can approve it. If an attacker gains access to those systems, they may be able to trigger unauthorized transactions without taking the private keys themselves.
Binance's November 3 report provides a clearer explanation. Using the compromised signing service, attackers exploited an Ethereum feature called EIP-7702 to grant an attacker-controlled smart contract permission to execute transactions from a hot wallet. Those permissions operated outside Binance's normal withdrawal process, so suspending withdrawals did not immediately stop the unauthorized transfers.
Crypto platforms often use both hot wallets and cold storage.
Hot wallets are connected to the internet. They make it easier to process deposits and withdrawals, but that connection also creates exposure to online threats.
Cold storage keeps private keys offline, reducing exposure to certain online attacks. Accessing assets in cold storage usually takes more steps and more time, though, and offline storage brings its own operational risks.
Whether assets are held in a hot wallet or cold storage, controls over access and transfers matter too. These can include restricting who can authorize transactions, requiring multiple approvals for certain transfers, and monitoring unusual activity.
The incident happened outside Canada, but the custody questions it raises apply here too.
In February 2026, the Canadian Investment Regulatory Organization (CIRO) introduced an interim Digital Asset Custody Framework. It sets expectations for how CIRO dealer members operating crypto trading platforms hold assets and manage custody risks, including when they use third-party custodians.
Under this framework, dealer members can generally hold up to 20% of the value of crypto assets held for clients and for their own account through internal custody arrangements, subject to specific requirements. The remaining assets must be held with CIRO-approved crypto custodians that meet the framework's standards.
For now, these requirements are applied through conditions of CIRO membership while permanent rules are being developed.
Regulation provides oversight and standards aimed at providing safeguards to investors, but it can’t prevent every cyberattack.
The Canadian Investor Protection Fund (CIPF) provides limited protection for eligible client property of its members if a member firm becomes insolvent and cannot return it; however,
there's an important distinction between cash and crypto assets with respect to coverage eligibility.
Eligible cash balances, including Canadian and U.S. dollars held in a crypto trading account with a CIPF member, may be protected up to applicable coverage limits if the member firm becomes insolvent. Crypto assets themselves are not covered by CIPF. Private insurance works differently: some trading platforms or their custodians maintain policies that may cover specific losses, such as certain theft events, depending on the policy's terms, limits, and exclusions. You can learn more about CIPF eligibility on the CIPF website.
In other words, regulation, CIPF protection, and private insurance are different things. It’s worth knowing which protections apply to your assets on any platform you use.
Not every crypto attack starts in the same place.
Account-level risks include phishing, stolen passwords, and someone gaining access to your device or login. Multi-factor authentication (MFA), unique passwords, and checking links carefully can help reduce some of these risks.
Platform-level risks involve the systems that hold assets or approve transactions. A problem with internal access, custody controls, or withdrawal approvals may affect assets even when an individual user's login hasn't been compromised.
You don't need to know every technical detail to understand the basics. These questions are a good place to start:
Not every internal security measure will be public. But the way a platform holds assets, handles incidents, and explains risk should be understandable.
Here’s how Newton answers the questions above.
Custody and segregation
At least 80% of Newton’s total client crypto assets are held in cold storage with third-party custodians, primarily Coinbase Custody and BitGo. These assets are kept in segregated trust accounts, separate from Newton’s own assets and from the custodians’ other clients. Up to 20% is held in hot wallets secured using Fireblocks to support trades, deposits, and withdrawals.
Security controls
Newton requires MFA on every account and uses 24/7 monitoring and annual third-party penetration testing. For assets held with custodians, those custodians control the private keys, while Newton sends withdrawal instructions based on requests from client accounts.
Protections and limitations
Hot wallets are exposed to online threats, and third-party custody carries operational and insolvency risks. Custody providers also maintain insurance policies that may cover certain losses, subject to the terms, limits, and exclusions outlined in Newton’s Risk Disclosure.
The Binance incident shows why crypto security goes beyond personal passwords and private keys. Custody, internal controls, and the way a platform approves withdrawals all play a part.
No single safeguard eliminates every risk. Knowing how a platform operates, and what its protections do and don't cover, gives you a clearer picture of where those risks lie.
For more on this topic, read our breakdown of crypto custody risks and trade-offs, or learn about Newton's approach to security.
.png)