---

Discussion

Omar Seidren:

Usually, the customer does not control the private keys to a personal Bitcoin address. Binance controls operational wallets and records the customer’s entitlement in an internal ledger. Customers can trade internally without an on-chain transaction; withdrawals require Binance to authorize and sign an external transaction. That is custody, not self-custody.

Red Velhouse:

Why accept that dependence?

Omar Seidren:

Because self-custody solves one problem by creating others. Binance offers deep order books, rapid execution, many trading pairs, fiat and stablecoin conversion, derivatives, payment rails, and account recovery. For active traders, custody is a service choice: convenience and liquidity exchanged for dependence on someone else’s systems.

Sam Dewinski:

It is a familiar historical bargain. Financial institutions became popular by pooling liquidity and handling operations individuals could not easily perform. Crypto was marketed as an escape from intermediaries, yet convenience recreated one: a global exchange with automated software and a very large wallet cluster.

Sofia Jadler:

The legal price is counterparty risk. Customers depend on Binance’s solvency, accounting, cybersecurity, withdrawal controls, compliance decisions, banking relationships, and terms of service. An internal ledger is not automatically a separate legal trust or a bankruptcy-remote wallet. The result depends on the jurisdiction, product, and applicable terms.

Red Velhouse:

When people cite tens or hundreds of billions connected to Binance, what are they measuring?

Sam Dewinski:

There is no single, independently audited public number answering how much crypto Binance owns. Binance reported approximately $162.8 billion in user balances covered by its Proof-of-Reserves program at 2025 year-end, across 45 assets. That describes covered customer balances under a defined snapshot, not $162.8 billion of Binance’s proprietary assets.

Omar Seidren:

Proof of Reserves, or PoR, uses a Merkle tree and zk-SNARKs—zero-knowledge proofs—to let users verify that their balance was included in a liabilities calculation alongside corresponding assets in Binance-controlled wallets. That is useful cryptographic evidence, but it is not a conventional audit of every liability, off-chain obligation, related-party exposure, or asset outside the covered population.

Sam Dewinski:

A bitcoin-specific snapshot reported approximately 688,600 bitcoin in customer net balances and approximately 691,000 bitcoin in reserve-wallet balances on October 1, 2026. That suggests a modest cushion for covered bitcoin balances at that moment. It is not a count of every bitcoin Binance might control or an independent audit of beneficial ownership.

Sofia Jadler:

Arkham supplied a different measurement: an estimate of about $127 billion in crypto held by Binance-controlled on-chain entities in June 2026. Wallet clustering may combine customer assets, corporate assets, reserves, operational funds, and affiliates. Comparing that directly with customer liabilities compares different populations.

Omar Seidren:

The October 29 incident shows why concentration matters. Unauthorized transfers moved about $6.3 billion from Binance-controlled hot wallets across approximately ten networks. Most of the movement was rapid, followed by a later wave. The blockchains continued operating; the apparent failure was in exchange-side access, signing, or withdrawal authorization. Public reporting has described possible compromises involving Binance-related infrastructure, but the precise breach path remains unsettled.

Sofia Jadler:

That uncertainty matters when characterizing the economic loss. The public record did not establish that every dollar moved was customer property. Binance said it would protect customers and absorb the incident through corporate resources, reserves, and the Secure Asset Fund for Users, or SAFU. That may protect customers from immediate loss, but it is not an audited asset-by-asset accounting.

Omar Seidren:

The technical lesson is that many networks can share one failure point. Hardware-backed signing, independent approvals, transaction simulation, destination allow-lists, rate limits, anomaly detection, and an emergency pause can reduce risk. Independence matters: ten controls sharing one compromised identity system may be one control wearing ten hats.

Red Velhouse:

The suspected North Korean connection places this incident in a longer history. Sam, where should we start?

Sam Dewinski:

Before cryptocurrency, North Korean-linked operators targeted banks and payment infrastructure. In 2016, attackers attributed to North Korea used fraudulent SWIFT messages in an attempt to steal nearly $1 billion from Bangladesh Bank; about $81 million was transferred before detection. The precedent was an attack on international financial plumbing, followed by intermediaries moving the proceeds.

Sam Dewinski:

The focus then broadened to exchanges and crypto services. U.S. filings described 2019 thefts of more than $272,000 and nearly $2.5 million, plus approximately $250 million in related 2020 actions. Laundering included chain hopping, token swaps, Bitcoin and Tether conversions, Chinese over-the-counter traders, and layered accounts. The technology changed, but the strategy remained: take value from a weakly defended system and move it across jurisdictions faster than investigators can act.

Sofia Jadler:

In 2020, the Justice Department filed a civil forfeiture complaint against 280 cryptocurrency accounts tied to North Korean exchange hacks. A forfeiture complaint is not a criminal conviction, but it demonstrates a legal strategy: authorities can target assets and intermediaries even when the principal hackers are outside U.S. reach.

Sam Dewinski:

The targets expanded. Lazarus-linked actors stole approximately $620 million from the Ronin Bridge in 2022, and North Korean-linked actors stole approximately $100 million from Harmony’s Horizon Bridge. In 2023, major thefts hit Atomic Wallet, Alphapo, and CoinsPaid. The targets included bridges, custodians, payment processors, and the employees connecting crypto to the wider economy.

Red Velhouse:

And Bybit showed the scale of the modern operation.

Sam Dewinski:

On February 21, 2025, the FBI attributed approximately $1.5 billion stolen from Bybit to North Korean TraderTraitor actors. Some assets were rapidly converted into bitcoin and other virtual assets, then dispersed across thousands of addresses and multiple blockchains. It exploited an entire settlement ecosystem, not merely one institution.

Omar Seidren:

A public blockchain helps investigators follow addresses, swaps, bridges, and clusters, but tracing is not control. Stablecoin issuers can sometimes freeze their tokens; bitcoin and ether generally cannot be frozen by an issuer. Attackers often convert issuer-controlled assets into harder-to-freeze native assets. Slippage, blocked accounts, failed cash-outs, and discounted sales can reduce usable value, but there is no authoritative public recovery percentage.

Sofia Jadler:

The legal response is real but limited. The United States sanctioned Lazarus Group in 2019 and Blender.io in 2022, saying Blender processed more than $20.5 million connected to the Ronin theft. Treasury removed its economic sanctions against Tornado Cash in March 2025 while continuing to warn about North Korean laundering. Sanctions raise costs, but they do not arrest operators in North Korea.

Sofia Jadler:

Authorities have also pursued forfeiture. In June 2025, the Justice Department sought more than $7.74 million allegedly laundered for the North Korean government. In November, it announced actions involving more than $15 million in Tether’s USD-pegged stablecoin, USDT, allegedly stolen and laundered by APT38 actors; the funds had been seized in March. Prosecutors have charged facilitators, seized accounts and devices, disrupted infrastructure, and offered rewards of up to $5 million.

Sam Dewinski:

History supplies the counterpoint. Sanctions and indictments can expose intermediaries, make cash-out harder, and raise procurement costs. They have not prevented repeated large-scale thefts or arrested the principal operators behind the largest campaigns. North Korea’s isolation, foreign intermediaries, front companies, mixers, over-the-counter markets, and unhosted wallets create a persistent enforcement gap.

Sofia Jadler:

The key distinction is between identifying a flow and obtaining control of an asset. An issuer may freeze a stablecoin; an exchange may cooperate; a court may authorize seizure and later forfeiture. Restitution is another step. A wallet address is not automatically a defendant, and a blockchain transaction does not itself give investigators authority to seize funds.

Red Velhouse:

What does this history suggest about North Korea’s objective?

Sam Dewinski:

The public evidence supports treating digital theft as part of a broader state revenue and procurement strategy. Treasury assessments describe digital-asset theft alongside fraudulent overseas information-technology work and sanctions evasion as sources of foreign currency for the regime and its weapons programs. A 2026 assessment said North Korean actors stole at least $2.8 billion in digital assets from January 2024 through September 2025. That does not tell us how much became usable state revenue, but it explains why these attacks matter beyond individual victims.

Omar Seidren:

Technology helps both sides. Analytics can connect infrastructure and alert exchanges before a cash-out completes. Attackers respond with faster swaps, bridges, mixers, structured transfers, and thousands of fresh addresses. It is an arms race between visibility and control. The ledger remembers; the question is whether an institution has the authority and practical ability to act on what it remembers.

Red Velhouse:

What should viewers watch next in the Binance case?

Sofia Jadler:

Watch for formal government attribution, a seizure or forfeiture filing, and evidence tying named individuals or facilitators to access, authorization, movement, and laundering decisions. Also watch how Binance defines its customer obligations. Replacing assets is strategically valuable, but it differs from an issuer freeze, a court seizure, and eventual restitution.

Omar Seidren:

Watch for a credible forensic account of the breach path and independent evidence that new controls are separated from the systems that failed. Restoring withdrawals matters, but the deeper test is whether hardware-backed signing, independent approvals, anomaly detection, and emergency stops work when an attacker reaches the automation layer.

Sam Dewinski:

And watch the holdings language. Ask whether a cited Binance total means covered customer balances, a bitcoin reserve snapshot, or an on-chain estimate of clustered entities. Scale can create liquidity and resilience, but it can also create an extraordinarily valuable target.

Red Velhouse:

Binance is valuable because it concentrates liquidity, products, payment access, and convenience. That same concentration means customers trade self-custody for dependence on an intermediary’s accounting, security, liquidity, and legal obligations. The clearest holdings figures must be labeled: approximately $162.8 billion in company-reported Proof-of-Reserves-covered user balances; approximately 688,600 bitcoin in reported customer net balances against approximately 691,000 bitcoin in reserve-wallet balances in one snapshot; and an approximately $127 billion on-chain estimate that may combine customer, corporate, affiliate, and operational assets. None is a complete independently audited total of Binance’s holdings. The October incident involved an apparent unauthorized movement of approximately $6.3 billion from Binance-controlled hot wallets, but the public record has not established that the entire amount was customer property or that it represents a final customer loss. North Korea’s record, from Bangladesh Bank through exchange hacks, Ronin, Harmony, payment processors, and Bybit, shows both the power and limits of digital enforcement. Authorities have traced, frozen, seized, forfeited, and prosecuted intermediaries, but they have not stopped repeated thefts or recovered a reliably dominant share of all proceeds. Watch for forensic findings, evidence of customer-asset coverage, movement or seizure of transferred funds, and proof that custody controls—not just public promises—can withstand the next attack. Sources and references for this discussion are available with the episode at Factolio.com.

---

Sources and References

These sources supported the factual material used in this discussion. Factolio’s panel discussion is AI-generated from researched evidence and is written in original language.

1. Binance — Binance incident statement and customer-protection announcement (PRIMARY)
2. TRM Labs — Analysis of the October 2026 Binance incident (ANALYSIS)
3. Blockchain intelligence and incident reporting — October 2026 Binance incident asset movements (NEWS)
4. Blockchain intelligence and incident reporting — October 2026 Binance incident multi-chain analysis (NEWS)
5. Binance — Statement on withdrawals, SAFU, and replacement of affected assets (PRIMARY)
6. Binance — SAFU and corporate-resources funding commitment (PRIMARY)
7. Federal Bureau of Investigation — North Korea Responsible for $1.5 Billion Bybit Hack (PRIMARY)
8. Reuters — Reporting on the Binance investigation and law-enforcement cooperation (NEWS)
9. Associated Press / established financial press — Reporting on the October 2026 Binance incident (NEWS)
10. U.S. Department of the Treasury — 2026 National Proliferation Financing Risk Assessment (PRIMARY)
11. Binance — Proof of Reserves and zk-SNARK verification (PRIMARY)
12. Binance — State of the Blockchain: 2025 Year in Review (PRIMARY)
13. U.S. Department of Justice — Binance corporate resolution and compliance enforcement (PRIMARY)
14. Binance PoR data reported for October 1, 2026 — Bitcoin customer and reserve balances (PRIMARY)
15. Federal Bureau of Investigation — Bybit theft attribution and laundering warning (PRIMARY)
16. U.S. Department of the Treasury — Blender sanctions and Ronin theft (PRIMARY)
17. Federal Bureau of Investigation — Harmony Horizon Bridge theft attribution (PRIMARY)
18. U.S. Department of Justice — North Korean cybercrime and cryptocurrency indictments (PRIMARY)
19. U.S. Department of the Treasury — Tornado Cash delisting and DPRK cyber threats (PRIMARY)
20. U.S. Department of Justice — North Korean cryptocurrency forfeiture and laundering cases (PRIMARY)
21. U.S. Department of Justice — North Korean financial cybercrime indictment record (PRIMARY)
22. Arkham — Binance-controlled on-chain entity estimate (DATA)
23. Binance — Jurisdictional terms and custody structure (PRIMARY)
24. Independent analysis of Proof of Reserves limitations — Proof of Reserves, liabilities, and solvency limitations (ANALYSIS)
25. Binance — Customer-protection and replacement-reserve statements (PRIMARY)
26. Binance — Binance global exchange and custody terms (PRIMARY)
27. Kaiko — Liquidity Flywheel Drives Binance to 300 Million Users (DATA)
28. Binance Square / PANews — October 1, 2026 Binance reserve and customer-balance figures (ANALYSIS)
29. U.S. Department of the Treasury — DPRK digital-asset theft and proliferation-finance context (PRIMARY)
30. U.S. Department of Justice — North Korean government revenue-generation forfeiture action (PRIMARY)
31. Binance — Proof of Reserves (PRIMARY)
32. Binance — Understanding Your Accounts and Wallets on Binance (PRIMARY)
33. Binance — Terms of Use (PRIMARY)
34. Binance — State of the Blockchain: 2025 Year in Review (PRIMARY)
35. Binance Square / PANews — The Compensation Bill Behind Binance's $6.3 Billion Loss: Where Will the Money Come From? (ANALYSIS)
36. U.S. Department of Justice — United States Files Complaint to Forfeit 280 Cryptocurrency Accounts Tied to Hacks of Two Exchanges by North Korean Actors (PRIMARY)
37. Federal Bureau of Investigation — FBI Identifies Cryptocurrency Funds Stolen by DPRK (PRIMARY)
38. U.S. Department of Justice — Justice Department Announces Nationwide Actions to Combat Illicit North Korean Government Revenue Generation (PRIMARY)
39. Federal Bureau of Investigation — North Korea Responsible for $1.5 Billion Bybit Hack (PRIMARY)
40. U.S. Department of the Treasury — U.S. Treasury Issues First-Ever Sanctions on a Virtual Currency Mixer, Targets DPRK Cyber Threats (PRIMARY)
41. U.S. Department of the Treasury — Tornado Cash Delisting (PRIMARY)
42. U.S. Department of Justice — Department Files Civil Forfeiture Complaint Against Over $7.74M Laundered on Behalf of the North Korean Government (PRIMARY)
43. U.S. Department of Justice — Justice Department Announces Nationwide Actions to Combat Illicit North Korean Government Revenue Generation (PRIMARY)
44. U.S. Department of Justice — Nine Charged with Alleged Scheme to Generate Revenue for North Korean Government and Its Weapons of Mass Destruction Program (PRIMARY)
45. U.S. Department of the Treasury — 2026 National Proliferation Financing Risk Assessment (PRIMARY)