Binance customers are being repaid from the exchange’s own money after a theft of about $6.3 billion. Their protection rests on Binance’s commitment and its resources. A bank depositor’s rests on statute. For banks now issuing tokens, that is the line that counts.
What Binance Has Said
Binance says its hot wallets were compromised at around 20:05 UTC on October 29. It puts the impact at about $6.34 billion in digital assets.
On October 31 the FBI said North Korea was “responsible for the theft of more than $6 billion USD in virtual assets” from Binance. The FBI calls the activity TraderTraitor, and says the stolen assets are being converted mainly into Ethereum.
Binance says its first finding pointed to a compromised laptop, and that later work found additional points of breach. It says it has found no evidence that wallet private keys leaked. About $2.85 billion has been frozen or intercepted, subject to reconciliation. Frozen funds have not been returned.
Binance says it has set aside more than $6.34 billion of company funds and will absorb the loss, not its users. The money comes from a partial draw on its Secure Asset Fund for Users (SAFU) and from its corporate treasury. Binance says 98 percent of impacted token assets had been replaced by October 31, and that it is buying the remaining, less liquid assets.
Binance has committed to restoring SAFU to about $1 billion. The loss was about $6.34 billion. Most of the cost is falling on the company’s own balance sheet.
Binance says ten major tokens, including BTC, ETH and USDT, were fully backed in its October 31 Proof of Reserves snapshot, which users can verify. A snapshot shows backing on one date. It is not insurance.
What the Law Provides
A bank deposit is a claim on the bank. In the United States, if an insured bank fails, the FDIC covers deposits up to $250,000 per depositor, per insured bank, for each account ownership category. Cover is automatic. It does not depend on the bank’s decision or its resources at the time.
In the European Union, MiCA Article 75 requires crypto custodians to keep client assets legally and operationally separate from their own, so that the firm’s creditors “have no recourse” to them in insolvency. The same article makes a custodian liable for losses from incidents attributable to it, capped at the market value of the assets when the loss occurred. A custodian is not liable if it shows the incident occurred independently of its service or operations. Firms that use insurance to meet part of their prudential requirement must have a policy that covers this liability.
MiCA also requires advisers to warn clients that crypto-assets are not covered by deposit guarantee schemes. Its protections are custody duties and liability rules. They are not a guarantee scheme.
Where Banks Come In
Banks issuing digital money are choosing which protection applies to each product.
HSBC launched RedCoin in Hong Kong on October 23. It is a stablecoin licensed and regulated by the Hong Kong Monetary Authority, available to more than 3.3 million PayMe users. HSBC also runs a tokenised deposit service for wholesale payments. The bank now offers both a stablecoin and a tokenised deposit.
SoFi launched SOFIE on October 22. Each token represents $1 held on deposit at SoFi Bank and is FDIC insured up to applicable limits. Customers can convert SOFIE one for one into SoFiUSD, the bank’s stablecoin. SoFi’s disclosures state that digital assets other than SOFIE are not FDIC insured.
Binance’s response shows what one large exchange could pay for. It does not set a floor for the industry. For banks, the question is the legal claim behind each token, not the technology. A tokenised deposit is a deposit and carries deposit insurance up to the limit. A bank stablecoin may not. Banks that issue both should tell customers, at the point of conversion, which protection they keep and which they give up.
