Binance Lost $6.3 Billion. Here's Who Pays You Back
The largest crypto hack on record, and why Binance's users and WazirX's users got such different answers. What the FDIC and the UK's FCA say about crypto held on an exchange.
On 29 October 2026, Binance said a security incident "impacted about $6.3 billion in client assets". CNBC called it the largest crypto hack on record. The question most people with an exchange account asked next wasn't how. It was who pays.
What Binance said
At first, that the hack "may involve a compromised DevOps engineer's laptop, which allowed an attacker to gain access to a service container" (CNBC, 29 October). Its co-CEO later said the attack was more complex than one engineer's permissions. Binance said it found no evidence of a wallet private key leak, and deposits kept working while withdrawals were paused.
Where the repayment money came from
- Part of its Secure Asset Fund for Users (SAFU), which it will top back up to about $1 billion.
- Part of its Futures insurance fund.
- Its own corporate treasury: more than $6.34 billion set aside, it said on 31 October.
Binance will absorb the financial impact of the stolen funds, not our users.
— Binance, Security Incident Recovery Update #4, 1 November 2026
The same update said the top ten tokens were fully backed, about 95% of the loss was covered, and the last 5% was in less liquid tokens it was still buying. Withdrawals reopened in phases on 1 November, Bitcoin first (CNBC, 31 October, updated 1 November), and the FBI has said North Korea was behind the attack.
WazirX, India, 2024
When India's WazirX lost more than $230 million in July 2024, it halted trading and withdrawals. Nearly 15 months later, Singapore's High Court approved a repayment plan: 85.5% of each portfolio's value, and recovery tokens for the remaining 14.5% (Medianama, 15 October 2025).
What the rules cover
- US: the FDIC says deposit insurance doesn't apply to crypto assets, and doesn't protect against the failure of non-bank firms "including crypto custodians, exchanges, brokers, wallet providers, and neobanks".
- UK: the FCA's required crypto risk warning says you "should not expect to be protected if something goes wrong".
- Anywhere else: check your own regulator's page before you assume.
The exception: a user protection fund and a proof of reserves don't promise you'll be paid back. They show what an exchange could pay with, which is more than most people check. This is information, not investment advice.
This is the long version of What Just Happened #01, a reel for @buildjayy on Instagram. If you're building an app, send me the word BUILD there, or start with the brief form on the front page.
Sources: CNBC, $6.3 billion Binance hack is largest crypto theft on record (29 October 2026, updated 30 October) and Binance resumes withdrawals following record $6.3 billion hack (31 October 2026); Binance, Security Incident Recovery Update #3 (31 October 2026) and #4 (1 November 2026); Medianama, WazirX's amended repayment plan (15 October 2025); FDIC, Fact Sheet: deposit insurance and crypto companies; FCA, PS23/6 (June 2023). Dev's scenes in the reel are AI video (Gemini).
- 1 Nov 2026
- Published, with the reel. Figures as of 1 November 2026.
Product builder from Surat. Ships his own apps, runs live broadcasts, and takes on a few founders a year for product, brand and growth. hey@jaybutani.com