The theft of $6.3 billion from Binance on Oct. 29 was the largest crypto heist on record, and most of it happened in about 20 minutes, according to Reuters. Binance says its customers will not lose a cent. That promise is welcome. It is also the problem: customer safety at the world's biggest exchange rested on how much money one company was willing and able to spend.

Asia's regulators should treat the hack as a test of rules they have already written, and close the gaps between them.

A Private Backstop Is Not a Rule

Binance's response was fast. It halted withdrawals, set aside about $6.34 billion of company funds and said on Oct. 31 that it had replaced 90% of the stolen assets, drawing on its $1 billion Secure Asset Fund for Users, its futures insurance fund and its corporate treasury, Reuters reported. By Nov. 1 it said it had covered 95%. Stablecoin issuers Tether and Circle froze roughly $2.4 billion linked to the theft between them. Bitcoin and ether cannot be frozen, because no single party controls them.

The damage still spread. Bitcoin hit a six-week low and ether a two-month low, and shares of Coinbase, which said it was unaffected, fell 4.8%. Our news report on bitcoin's 7.3% October loss traces how the hack hit a market already weighed down by higher U.S. rates and ETF outflows.

Note what covered the hole. The $1 billion user fund was less than a sixth of the loss. The rest came from a balance sheet that few exchanges could match. Binance reported about $162.8 billion in assets under custody in its 2025 annual report, according to Reuters. A smaller platform hit the same way would have had no such cushion.

The cause was ordinary. Binance said the breach may have started with an engineer's compromised laptop, which gave the attacker access to systems that process withdrawals. Blockchain analysis firms TRM Labs and Chainalysis said they were highly confident North Korea was behind it, and the FBI on Oct. 31 attributed the attack to a North Korean unit it calls TraderTraitor. North Korea routinely denies such accusations. Whoever is responsible, the method was a familiar one. Asian investors know it well: Japan's DMM Bitcoin lost bitcoin worth about 48.2 billion yen in 2024, Reuters reported at the time.

Four Regimes, Four Bars

The region's main markets already regulate custody, but not to the same standard. Hong Kong's Securities and Futures Commission requires licensed trading platforms to keep 98% of client crypto in cold storage, offline and away from the internet, according to a summary of the rules by the accounting firm Forvis Mazars. Platforms must also hold compensation arrangements covering 100% of client assets in hot storage and 50% of those in cold storage, through insurance, a bank guarantee or funds set aside on trust, the summary says.

South Korea's Virtual Asset User Protection Act, in force since July 19, 2024, sets the cold-storage floor at 80% of the economic value of user assets, the Financial Services Commission said. Korean exchanges must carry liability insurance or set aside a reserve to meet compensation claims, but the commission set no figure in its announcement. Singapore has focused on ownership rather than storage: the Monetary Authority of Singapore said in 2023 that digital payment token firms must hold customer assets under a statutory trust, to help clients recover them if a firm fails.

Each approach covers something the others miss. Hong Kong ties compensation to the assets actually at risk. Singapore protects customers in an insolvency. Korea writes its floor into statute. Japan, home of the DMM breach and the Mt. Gox collapse before it, has had the longest experience of what happens when these safeguards fail.

What Regulators Should Require

The Board's view is that the Securities and Futures Commission, the Monetary Authority of Singapore, Japan's Financial Services Agency and Korea's Financial Services Commission should agree a common minimum for any exchange serving their residents. Four elements matter.

First, client assets held in trust or a legally equivalent structure, separate from the exchange's own money, in every market. Second, a cold-storage floor of at least 95%, with insurance or ring-fenced reserves sized to the full value of whatever sits in hot wallets. A fund that covers one-sixth of a worst case is a marketing tool, not a safeguard. Third, proof of reserves checked by an independent auditor at least quarterly, covering liabilities as well as assets. Binance's own snapshot, taken at 00:00 GMT on Oct. 31 for 10 tokens, is a start, but it is self-reported. Fourth, mandatory notice to the regulator within hours of a breach, and public disclosure of the amount and assets affected within a day.

Industry is already asking for part of this. OKX chief executive Star Xu called for a real-time alert system so exchanges can share information and freeze suspected stolen funds, Reuters reported. Regulators can turn that idea into a standing channel between licensed platforms and supervisors.

None of this would have stopped a determined attacker from phishing an engineer. It would ensure that the next time it happens, customers are protected by rules rather than by a single company's treasury. Regulators should agree that standard before the next breach, not after it.