There is no shortage of commentary on the Binance hack. It seems that almost overnight everyone has become a security expert with their own version and interpretation of events. I won't go into that detail, but the focus of the coverage has been around the compromised laptop, the EIP-7702 delegation, the 50 pre-signed authorisations, and the 20 minutes it took to move more than six billion dollars. Those details matter, and the teams who investigate them deserve credit.
However, another important lesson of the past week is not technical. It is structural. Whenever a very large share of assets sits with one counterparty, a single failure stops being an incident and becomes an event. The industry has a name for this, and it is one Bitcoin holders rarely use: concentration risk.
This is not an article about Binance's failings, and it is not a pitch dressed up as analysis. Binance has said customer funds are safe, and many of the people working through this incident are doing so with real professionalism. That itself has huge merit. However, the point is broader, and it applies to every counterparty in this industry, Xapo included. Choosing the right counterparty, and not placing everything with any one of them, is the most important risk decision a serious holder makes.
What happened at Binance
For anyone who isn't already aware and for general context, on the evening of 29 October 2026, an attacker moved approximately $6.36 billion out of Binance wallets across ten blockchains, most of it in about 20 minutes from 20:05 UTC. According to TRM Labs, it is the largest crypto theft on record, roughly four times the $1.5 billion Bybit hack of February 2025. And according to the FBI, it is attributed with high confidence to TraderTraitor, the North Korean unit behind Bybit.
The sequence, as reported so far:
The entry point. Early public accounts describe a compromised DevOps engineer's laptop, followed by access to a service inside the withdrawal stack. Binance has not yet published a root cause.
Patient preparation. The attacker's operator wallet was funded through Tornado Cash at least 36 hours before the theft, and the attack code was rehearsed on test wallets the same day.
The Ethereum takeover. Using EIP-7702, a feature introduced in Ethereum's Pectra upgrade in May 2025, the attacker submitted 50 pre-signed authorisations, each for a different transaction count. Blockaid's analysis showed only one needed to land. It did, and the hot wallet's code was delegated to a sweeper contract that only the attacker could call.
Everything else, at once. In the same window, Binance wallets on Bitcoin, Tron, the XRP Ledger, Solana and five other networks sent funds to the attacker through ordinary, validly signed transfers. Different chains, different key types, different signing schemes, all within about half an hour.
That last point is the one to sit with. TRM's assessment is that the attacker gained the ability to make Binance's hot wallet signing system sign transactions of its choosing, across chains. As David Marcus, who ran PayPal through a comparable intrusion in 2014, put it, "Nobody broke cryptography or a ledger. They found someone with access and used the trust that came with it."
Stablecoin issuers and Arbitrum's Security Council froze around $2.7 billion between them. The attacker still controls roughly $2.4 billion in ETH and BTC that no issuer can reach.
The risk that isn't being discussed: trust inside the system
Most coverage will frame this as a crypto problem. It is not. It is an operational risk problem, and banks have been managing it for decades. The attack did not defeat Bitcoin, Ethereum or any cryptographic primitive. It defeated an internal chain of trust. A laptop trusted by a network, a service trusted by a signer, a signer trusted to approve whatever that service sent it.
That is why the right questions are about architecture and governance, not about which chain or which token:
Is there any single path that can authorise movement of funds? If one compromised system can produce valid signatures across every wallet, the number of wallets is irrelevant. There is effectively one key.
Are signing systems separated by chain, wallet tier and purpose? TRM's own guidance after this incident is that signing infrastructure and approval paths should be segregated, so that no single actor can obtain valid signatures for wallets on ten chains within hours.
Does anything slow funds down? Hot wallets exist to be fast. Long-term holdings should not be. Time delays, withdrawal limits and independent approvals turn a 20-minute drain into a window in which someone can act.
Is the operating model built around the client's assets, or around trading volume? An exchange's hot wallet infrastructure is engineered for throughput. A custodian's should be engineered for the opposite.
These are the principles Xapo's security architecture is built on. Multi-Party Computation so that no complete private key exists in any one place. Key shards distributed across HSM-protected, geographically dispersed facilities; and, for the BTC Vault, a mandatory 48-hour withdrawal delay. No institution should claim to be immune, and we do not. The point is that a model designed around removing single points of failure makes the failure seen last week far harder to reproduce.
Concentration: the lesson that outlasts the headline
Strip away the specifics, and the Binance incident has a simple shape. One organisation held an enormous pool of assets. One compromised pathway inside that organisation reached almost all of it at once. That is what concentration risk looks like when it crystallises. Not a gradual loss, but a single event with an outsized blast radius.
The same structural question applies well beyond exchanges. Consider the US spot Bitcoin ETF market, the product that was meant to bring Bitcoin into the institutional mainstream. As of April 2026, funds naming Coinbase as custodian or primary custodian held around $77 billion of the market's $91.7 billion, about 84%, according to CryptoSlate's analysis of fund filings. On a stricter count that excludes multi-custodian funds, the figure is still about 81%. Bitwise has published a similar estimate of 80–84%, and Coinbase itself describes its share as more than 80%.
To be clear, this is absolutely not a claim that Coinbase is insecure, or that ETF assets are exposed to what happened at Binance. ETF assets are held in segregated custody accounts, largely in cold storage, under qualified-custodian rules and with insurance arrangements. Those protections are real.
The point is narrower, and it is about dependency rather than competence. When four-fifths of a market's assets rely on one provider's operations, a single outage, a single enforcement action, a single licensing dispute, or a single successful intrusion stops being one firm's problem. It becomes a market-wide event, affecting creations, redemptions, and confidence across nearly every fund at the same time. The tools to diversify already exist. Fidelity self-custodies, VanEck uses Gemini, and several prospectuses disclose backup custodians. What has been missing is the will to use them before something forces the issue, or the understanding of the need for layers of diversification.
Binance has just shown, at scale, what "something" can look like.
How serious money already handles this
None of this is new. Traditional wealth management learned these lessons the hard way, and the people who manage large fortunes professionally rarely leave everything with one institution.
Lehman Brothers, 2008. Hedge funds that used Lehman as their prime broker found their assets frozen in the bankruptcy. It was nearly five years before the trustee announced that brokerage customers would be repaid in full. The money was largely recovered. The access was not. The industry's response was the shift to multi-prime brokerage, spreading assets and financing across several prime brokers so that no single failure could freeze a fund. Before 2008, that was mainly a practice of the largest funds. It is now standard for mid-sized and large managers.
Silicon Valley Bank, 2023. When SVB failed, Roku disclosed that about $487 million, or 26% of its cash, was held there, largely uninsured. What allowed it to tell the market it still had enough cash for the next twelve months was the other $1.4 billion, spread across other large institutions. Circle, which used six banks for the cash portion of USDC's reserves, still had $3.3 billion, about 8% of reserves, at SVB. USDC briefly fell to $0.88. Diversification softened the blow. Partial diversification did not prevent it.
Family offices. Private wealth advisers routinely recommend that families keep at least two banking relationships. One for custody of investment assets, another for banking and lending. Investment management is typically spread across several managers. Interestingly, the same advisers often recommend a single, strong master custodian for securities. That is not a contradiction. It works because traditional custody assets are legally segregated, are not the custodian's property, and are unlikely to be lost if the custodian fails. Families concentrate where the legal and operational structure makes concentration safe, and diversify where it does not.
That distinction is the heart of the matter. Concentration is not automatically wrong. Unexamined concentration is. The question is never only "how many counterparties?" It is "what exactly happens to my assets if this counterparty has its worst day?"
The ColdCard lesson, again: the right solution for the right person
A few months ago I wrote about the ColdCard firmware flaw that allowed attackers to regenerate private keys offline and drain more than 1,750 BTC from over 5,000 addresses. The argument then was simple. Self-custody is a right, but it is not a guarantee, and it is not the correct answer for everyone.
The Binance issue teaches us the same lesson. ColdCard showed what happens when everything rests on one device. Binance shows what happens when everything rests on one institution's internal plumbing. In both cases, the failure was silent until it was total, and in both cases, it took minutes, not days.
The conclusion is the same too. There may be no single “correct” way to hold Bitcoin:
Self-custody suits holders who are technically capable, operationally disciplined, and holding amounts they can defend.
Exchanges are built for trading and liquidity. They are a venue, and are rarely the right long-term home for wealth.
Regulated custodians and banks suit holders who want institutional security, legal segregation, supervision and continuity, including what happens to their Bitcoin after they are gone.
Most serious holders will use more than one of these, deliberately, for different purposes. That is not indecision. It is risk management.
Know your counterparty: the questions worth asking
If the lesson is to choose counterparties carefully, holders need a way to tell them apart. Brand, size and marketing are not that way. These questions are:
Security architecture. Does any complete private key exist anywhere? Can any single system, person, or service authorise the movement of funds on its own? How are hot and cold holdings separated, and how much sits in each?
Governance and controls. Who can approve a withdrawal, and how many independent approvals are required? Are there time delays and limits on large movements? Is the internal approval path itself protected against a trusted insider, or a trusted laptop?
Legal structure and segregation. Are client assets held off the firm's balance sheet, in segregated, insolvency-remote structures? Are they ever lent out, pledged, or rehypothecated? What happens to them, in law, if the firm fails?
Regulation and supervision. Is the firm licensed for custody, by whom, and is it supervised in practice? Is it subject to audits, capital requirements and conduct rules?
Capital and resilience. Does the firm have the capital position to absorb an operational loss rather than pass it on to clients? Is there insurance, and what does it actually cover?
Track record and transparency. How long has the firm held Bitcoin and through how many cycles? Does it publish clearly how it secures assets, and does it answer these questions directly when asked?
A counterparty that answers these clearly earns a larger share of your trust. One that cannot should earn a smaller share, or none. And even the best answers do not remove the case for spreading meaningful wealth across more than one well-chosen institution.
The honest conclusion
The Binance hack will be studied for years, and the technical lessons about EIP-7702, signing infrastructure, and insider access will make the industry stronger. But the lesson that matters most to anyone holding meaningful wealth in Bitcoin is older and simpler.
No institution is immune. Not exchanges, not ETF custodians, not banks, and not us. What separates a bad day from a catastrophe is how the system was designed before that day arrived. How many independent locks stood between an attacker and the assets, what the law says happens to client property, and whether everything was ever in one place to begin with.
Traditional finance learned this through Lehman and SVB. Bitcoin is learning it through ColdCard and Binance. The answer, in both worlds, is the same. Understand your counterparties, choose them on substance rather than size, and never let one of them become your single point of failure.
Diversify your counterparties, not just your assets.
