When crypto gets hacked, who actually has the power?
$6.3 billion. That's the estimated impact of the security breach Binance disclosed overnight.
The most interesting part? The blockchain itself doesn't appear to have been the problem.
On 29 October, Binance experienced a major security incident involving unauthorised withdrawals.
According to the preliminary investigation, attackers may have compromised a DevOps engineer's laptop, gained access to an internal service and used it to submit fraudulent withdrawal transactions.
No evidence of leaked wallet private keys has been found.
Billions in digital assets, protected by sophisticated cryptographic infrastructure.
And the attack may have started with someone's laptop.
Turns out, the weakest link in a blockchain-based system doesn't necessarily have anything to do with the blockchain.
But that's only the beginning of the story.
Binance temporarily suspended deposits and withdrawals, began tracing the stolen assets and coordinated with industry partners to contain the damage.
By early 30 October, approximately $3 billion in affected assets had reportedly been frozen on-chain. Stablecoin issuers, including Tether and Circle, played an important role in that response.
We spend years talking about decentralisation, censorship resistance and removing intermediaries.
Then billions disappear. And suddenly, we're rather happy that someone has the power to freeze assets.
There's a paradox here.
Centralised control can create dangerous points of failure.
But it can also provide mechanisms to intervene when things go wrong.
If nobody can freeze your money, nobody can freeze the hacker's money either.
If someone can freeze stolen funds, that same power raises questions about who gets to decide when intervention is justified.
So who should have that power? And who holds them accountable?
Binance has committed to covering the losses using its SAFU fund and company resources. It has also promised an updated Proof of Reserves.
Reassuring, if the commitments are fulfilled.
But proof of reserves and proof of security are not the same thing.
Knowing that an exchange held certain assets at a particular moment tells you little about whether its employees, internal systems and withdrawal infrastructure can withstand an attack tomorrow. And knowing that funds were frozen doesn't mean they've already been recovered.
Perhaps the lesson isn't that crypto is risky.
Nor that centralisation is inherently bad.
It's that security, transparency, decentralisation and recoverability are different things. And improving one doesn't automatically solve the others.
Decentralisation needs to be about understanding who still has power, why they have it, and what happens when something goes wrong.
What do you think?
Would you rather have a financial system where nobody can freeze your assets, or one where someone can intervene when billions are stolen?
And is there a way to have the best of both worlds?