The Ultimate Crypto Safety Guide 2026 | Learn

Yesterday evening, somebody took about $6.3 billion out of Binance.

It is the largest theft in the history of crypto. It is more than four times the Bybit hack of February 2025. It is close to twice everything stolen by hackers in all of 2025 put together.

And as of 07:45 UTC on 30 October, Binance withdrawals are still suspended. Co-CEO Yi He said the company expects to begin resuming them "in the next 48 hours" while it completes a security revamp of the withdrawal service. So if your money was on the exchange on Thursday night, you may be waiting until Sunday to move it. Not because you did anything wrong. Because the exchange is the one holding it.

This guide is about making sure that is never your problem again.

It is not only about Binance, and it is not only about exchanges. We will look at how people actually lose crypto in 2026, which is almost never the way they expect. Then we will build a simple setup that limits the damage when something goes wrong, because something eventually does.

Some of this will be uncomfortable reading for an exchange to publish. We have included it anyway, including the parts that apply to us.

1. What happened, in plain language

On 29 October at about 20:05 UTC, five Binance wallets on the XRP Ledger emptied themselves. Within twenty minutes the same thing happened on Bitcoin, Tron, Solana and Optimism. By the end of the night, ten different blockchains had been drained.

Binance puts the total at about $6.3bn. TRM Labs counts $6.36bn on-chain; Chainalysis counts $5.91bn. The difference is mostly about which prices you use, not about what happened.

Here is the part that matters most. Nobody broke any cryptography. Binance's own statement, quoted by CNN, says its early investigation points to an engineer's laptop, "which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions." Binance adds that it has "found no evidence of any wallet private key leak."

In other words: the attackers did not steal the keys. They got into the place where the keys are used.

On Ethereum they did something clever with that access. A rule called EIP-7702, added to Ethereum in 2025, lets a wallet hand control to a smart contract, which is useful for things like paying fees in tokens. Using one such permission requires a signature from the wallet itself, and it only works at one exact moment in that wallet's queue of transactions.

So the attackers signed fifty of these permissions at once, covering the next fifty positions in the queue. One of them was bound to match. One did. The wallet handed itself to a contract the attackers controlled, and because Ethereum makes that handover permanent until it is cancelled, the attacker's contract was still attached more than three hours later, ready to sweep anything that arrived.

EIP-7702 was not broken and is not the cause. It needed Binance's own signature to work. The real breach was the ability to produce that signature. The rule just turned one act of theft into an automatic machine.

Two blockchain intelligence firms and an independent on-chain investigator have linked the theft to a North Korean group, though only TRM Labs has stated high confidence. No government has confirmed it, and Binance has not named anyone.

About $3bn has been frozen so far, mostly by Tether and Circle, who can freeze their own stablecoins. That is genuinely good news, and it is also where most readers get the wrong idea.

2. Frozen is not the same as returned

When an exchange is robbed, headlines say funds were "frozen" and everyone relaxes. Freezing only stops the money moving. Getting it back is a separate, slower problem.

Ari Redbord of TRM Labs, a former US federal prosecutor, explained it to CNBC: "A freeze stops the money from moving, and recovery follows through legal process." Eric Jardine of Chainalysis added that "there is no standard recovery timeline."

The number that should stay with you: Bybit has recovered $48.4m of the $1.5bn stolen from it, eighteen months later.

And a theft is not the only way a custodian loses your money. Sometimes the company simply fails, and then the law decides what you get back and when.

Look closely at FTX and Celsius. Those recovery percentages sound survivable until you see what they are percentages of. Both estates fixed claims in dollars at the date the company filed. Celsius creditors were valued at BTC $19,881. Everything bitcoin did afterwards belonged to the estate, not to them. Genesis creditors, in a case where the court refused to fix prices, got actual coins back and kept the gains.

One more, from 2016. When Bitfinex was hacked, it spread the loss across every single customer at 36%, including people whose accounts were never touched. They were repaid eight months later, and that was considered a good outcome.

Exchanges are not banks. There is no deposit insurance. As NBC News noted, refunds are left "up to the discretion of individual exchanges." Binance has promised to cover losses from its emergency fund and company money. Its emergency fund holds about 15,000 BTC, roughly $1.1bn to $1.2bn, around a fifth of what was taken.

3. It is almost never the code

Most people picture a hacker defeating encryption. That is not what happens.

TRM Labs' data for the first half of 2026 is the clearest picture anyone has published:

• Infrastructure and operational compromises: about 15% of incidents, about 76% of the money

• Smart contract exploits: 125 of 207 incidents, a small share of the money

The code gets attacked constantly and loses relatively little. The people and machines that hold and approve keys get attacked less often and lose almost everything.

Look at how the biggest recent thefts actually started:

The Bybit case deserves a closer look, because it is the one that teaches the most.

Attackers compromised a developer machine at Safe, the company providing Bybit's wallet interface. They then injected code into the website Bybit's signers used. That code was written to activate only for Bybit's specific wallet, so no other user would ever notice it. The signers checked the screen, saw a normal transaction, and approved it on their hardware wallets.

The screen was lying. The transaction actually sent to those hardware wallets replaced the wallet's own logic with the attacker's. After that, no signatures were needed at all. $1.5bn was gone.

This is called blind signing, and it is the single most important idea in this guide. The hardware wallet worked perfectly. The signatures were mathematically valid. The humans approved the wrong thing, because what a multi-signature transaction really says is unreadable on a small screen, so people check the website instead.

The DMM Bitcoin case shows the patience involved. An operative posing as a recruiter sent a developer at a wallet company a "coding test" on LinkedIn. The developer ran it. Months later, that access was used to intercept a real transaction and take $305m. A joint FBI and Japanese police statement confirmed the chain of events.

That same fake-recruiter campaign is still running. A four-government advisory in September 2026 reported more than 30,000 infected devices across over 100 countries.

4. The year hardware wallets broke

The standard advice has always been: buy a hardware wallet, buy it from an official source, and you are safe. In 2026 that advice stopped being sufficient, and it has not been widely noticed.

Four separate incidents this year:

Coldcard. A build mistake in firmware released back in March 2021 made some devices create seed phrases using weak software randomness instead of real hardware randomness. Security that was supposed to be 128 bits dropped to as little as 40 bits, which is guessable. Coinkite disclosed the flaw on 30 July 2026, and the largest single sweep moved 1,082 BTC in 41 minutes. Totals range from $70m to about $116m depending on who is counting. Coinkite's advisory says a BIP-39 passphrase adds an independent barrier, but warns that a short or reused one may still be guessable and that passphrase users should also migrate as soon as practical. Updating the firmware does not fix an already-weak seed: you have to generate a new one and move your coins.

Ledger. In October 2026 Ledger confirmed a physical implant inside devices sold by CryptoBilis, a reseller in Southeast Asia. The chip watches the screen while you set the device up, reads your 24 words, and sends them out over a mobile network using a built-in eSIM. It never touches the secure chip or the signing code. It just reads what you read. MediaMarkt pulled Ledger devices from shelves. Researchers estimate over $86m lost; Ledger says the figure is unverified.

Trezor. Independent researcher Joe Grand found devices bought on Facebook Marketplace and a TikTok shop with the microcontroller replaced. The fake firmware did not generate a random seed at all: it produced one of about a dozen phrases the attackers already knew. Trezor's position is that these were counterfeits sold through unauthorised channels rather than compromised Trezor product, which is a fair distinction and also the point: the device you buy is only as trustworthy as where you bought it.

Keystone. Attackers stole buyer records and, worse, a device authentication key that is burned in at the factory and cannot be changed, the key that lets a wallet prove it is genuine. Keystone is destroying 18,835 unsold devices.

Notice what every one of these has in common. The cryptography held. What failed was the seed at the moment it was created or displayed, and the path the device travelled to reach you. Ledger has said it is reviewing the controls that apply to its direct sales and to resellers, which tells you the distribution channel is now part of the threat model.

What actually helps:

• Generate your own seed on the device, and add a passphrase. A passphrase is an extra secret of your own choosing, on top of the seed. Make it long and unique: a short or reused one can be guessed. Coinkite also recommends generating a seed from at least 50 independent dice rolls rather than trusting the device alone.

• Verify the device before trusting it with real money. Use the maker's authenticity check, and be suspicious of any device that arrives already set up.

• Never type your seed phrase into anything. No genuine company will ever ask. In 2025 scammers posted physical letters with Ledger's logo asking people to scan a QR code and enter their recovery phrase.

• Keep a small amount on a new wallet first. Watch it for a while before moving everything.

5. When your data leaks, the risk becomes physical

This section is the one people skip. Please do not.

Your exchange holds your identity documents, your home address and a record of how much you own. When that escapes, the danger stops being financial.

Coinbase, May 2025. Overseas support contractors were bribed. Coinbase's own filing with the SEC lists what was taken: names, addresses, phone numbers, partial identity numbers, images of passports and driving licences, and account balance snapshots. The filing estimates the incident would cost "approximately $180 million to $400 million." A later state breach notification put the number of affected customers at 69,461, and Coinbase has said it refused a $20m extortion demand.

Ledger, 2020. About a million email addresses, and detailed records including home addresses for roughly 272,000 customers.

Meanwhile, violence against crypto holders has risen sharply. Chainalysis' data:

Home invasions were 26% of attacks in 2023, 14% in 2025, and 37% in 2026, a spike rather than a steady climb. Kidnappings are 52%, which Chainalysis describes as relatively stable year on year. Family members and acquaintances are now targeted in roughly a quarter to a third of cases. In France, authorities recorded 77 crypto-related kidnapping and extortion cases in the first half of 2026 alone, a national police count, measured on a broader basis than the Chainalysis figures above, so the two sets are not directly comparable. In January 2025 a co-founder of Ledger was kidnapped and had a finger severed; a ransom of around €10m was demanded.

Now the honest part, because this is where most articles overreach.

The direct link from leaked exchange data to these attacks is not actually proven. The most thorough academic study of the subject (Ordekian and colleagues, AFT 2024) examined interviews, 146 news reports and hundreds of forum posts. The routes it could document were people who already knew the victim, people with a public profile in crypto, and people who met strangers for face-to-face trades. No case it was able to document began with a leaked exchange database, but the paper does not test that route, and lists it as an open question for future work.

What is documented is adjacent and still alarming. Chainalysis links the French surge to a tax official accused of selling files on wealthy crypto holders, and to a breach at a crypto tax firm affecting 50,000 users.

So the fair conclusion is this. Leaked personal data is a plausible and officially suspected danger, not a proven cause. The proven risks are simpler and more personal: do not tell people how much crypto you own, do not meet strangers to trade cash, and be careful what your public profile reveals.

6. The setup that limits the damage

You cannot make yourself unhackable. You can make sure that no single failure takes everything. That is the whole goal.

Separate storage from activity. Most people keep one wallet and use it for everything. That wallet signs transactions, approves smart contracts, connects to websites, and it also holds their savings. One bad approval and it is all gone.

Split it into layers:

Cold storage. The majority of your holdings. A hardware wallet, with a seed you generated yourself, protected by a passphrase. This wallet has one rule and it is absolute: the only thing it ever signs is a send to an address you typed in yourself. No smart contract approvals. No connecting to websites. No "verify your wallet" messages. If it never approves anything, approval-based attacks cannot reach it.

Split it further. Two or three cold wallets instead of one. If something does go wrong, it reaches a portion rather than everything. This costs you almost nothing and is the single easiest improvement most people can make.

Hot wallet. A separate wallet with a small amount in it, used for connecting to applications and trying things. Assume it will eventually be drained. Size it so that would be annoying rather than devastating.

Trading capital. Whatever you are actively trading with, kept where you trade, and no more than that. Not your savings.

Then some habits, each of which exists because of a real loss:

• Never type your seed phrase anywhere. It belongs on paper or metal, offline, not in a photo or password manager.

• Review your approvals. Approval phishing took around $1bn between May 2021 and late 2023, the most recent period Chainalysis has published. Old approvals you forgot about are still live permissions.

• Check the whole address, not the ends. Address poisoning works by sending you a tiny transaction from an address that starts and ends the same as one you use, hoping you copy it from your history. One campaign generated 82,031 lookalike addresses over 66 days. Victims sent $69.7m to them, though most of that was a single $68m transfer the attacker later returned, leaving about $1.49m actually stolen, which tells you how close the near-misses get.

• Treat a job offer as an attack. If a recruiter sends you code to run, that is the DMM playbook exactly.

• Slow down when something is urgent. Urgency is manufactured. Real security problems can wait ten minutes.

And know this: in 2025, $17bn was lost to scams versus about $3.4bn to hacking. In total, being tricked cost people about five times more than being hacked did.

7. The DEX advantage: nobody can freeze your withdrawal

Everything above protects coins you are holding. The moment you trade, somebody else usually holds your money.

Binance's users are learning what that means right now. Their coins were not stolen: Binance says user funds are safe and it will cover losses. But as of 07:45 UTC on 30 October they still cannot withdraw, and the company's own estimate for restoring the service was another 48 hours. Custody risk is not only the risk of theft. It is the risk of not being able to leave.

The same applies to brokers who hold assets for you, and to any platform where your balance is a number in a company's database rather than something you control.

A decentralised exchange changes the arrangement completely. You keep your own keys, your money never sits in the company's account, and no DEX can suspend your withdrawal the way Binance did last night. That is the advantage, and it is the whole reason this section exists.

But "decentralised" is a marketing word on most websites, and some platforms that use it are custodial in every way that matters. So here is how to check before you trust one.

Six checks before you pick a DEX:

1. Custody. Can the exchange move your balance without your signature?

2. Settlement. Are state changes proved cryptographically, or just asserted?

3. Data availability. Is the data needed to rebuild your balance published somewhere you can reach?

4. Upgrade keys. Who can change the contracts, and is there a time delay before changes take effect?

5. Censorship. Two separate questions: can they stop you trading, and can they stop you leaving?

6. Escape hatch. If the exchange goes down or refuses to process you, is there a mechanism that still gets your funds out? If so, what triggers it, how long does it take, and does it cover open positions or only collateral?

Question four deserves emphasis. A contract that can be replaced instantly means every other guarantee is provisional. Ask whether today's rules could be swapped before you had a chance to react.

There are two broad designs in use, and the difference is worth understanding before you pick one.

The first puts the whole order book on-chain. Hyperliquid is the best-known example, and it is a serious piece of engineering: orders, cancellations and fills are all transactions agreed by a validator set, so nobody can quietly reorder or drop them.

That design has one consequence worth knowing about in advance. If the book is public, everything in it is public. On a fully on-chain exchange, anyone with no credentials at all can read any account: position size, entry price, leverage, unrealised profit and liquidation price. That is not a flaw, it is what transparency means. But it does mean your liquidation level is visible to everybody, including people who would find it useful.

The second keeps the order book off-chain and proves the results on-chain. That is what ApeX Omni does, and it buys a different set of protections.

Your funds sit in zkLink's smart contracts rather than in ApeX's wallets, so we cannot move your balance. Trades settle with zero-knowledge validity proofs, which means state changes are proved mathematically rather than asserted by anyone. And your positions stay private: a third party cannot look up your balance or your liquidation price, so nobody can see where your pain begins. Our order book runs off-chain, which is the trade-off that keeps your positions private.

There is also a forced withdrawal path. You can send a request directly to the contract on the base chain, without going through ApeX at all, and the sequencer is required to process it. If the system were abandoned entirely, there is a proof-based exit built into the protocol that does not require our cooperation. Not every decentralised exchange has one: some route withdrawals through validator signatures with no documented fallback if those signatures do not come.

Two limits worth stating plainly: that exit path covers collateral rather than open positions, and it has not been needed in production. It is a structural protection against the exchange failing, not a substitute for managing your own risk. It stops your money being trapped. It does not stop you being liquidated.

Neither design is "the safe one." They protect against different things. Pick based on which risk you actually care about, and run the same six checks on any other platform you are tempted by.

Race to the Top 50 is still running

ApeX is running a trading competition until 5 November, 10:00 UTC, with a prize pool of up to 10,000 USDT paid down to 50th place on the leaderboard.

The pool unlocks in tiers on total campaign volume, so it stays locked below 30,000,000 USDT and reaches the full 10,000 USDT at 100,000,000 USDT. Your score is the sum of four parts: trading volume, realised profit percentage, net deposits and referrals. Qualifying requires registration through the campaign page, at least 100 USDT in your perpetual futures account, at least 10,000 USDT of eligible volume, and a Top 50 finish.

Full rules and the prize table are in the Race to the Top 50 announcement.

Trading perpetual contracts carries a high level of risk and can result in the loss of your entire position. Leverage increases both gains and losses. Nothing in this article is financial advice, and nothing in it is a guarantee of security. Do your own research and never risk more than you can afford to lose.

If you need any help, feel free to reach out to our team on Discord.

• Website: https://www.apex.exchange

• Twitter: https://twitter.com/OfficialApeXdex

• Telegram: https://t.me/ApeXdex

The Binance figures are as reported at 07:45 UTC on 30 October 2026 and will change. The loss is Binance's own estimate of about $6.3bn; independent on-chain counts range from $5.91bn to $6.36bn. The frozen total was around $3bn at 00:52 UTC. The cause is Binance's preliminary finding and has not been independently confirmed, and no root-cause report has been published. Two blockchain intelligence firms and one independent investigator have linked the theft to a North Korean unit, with only TRM Labs stating high confidence; no government has confirmed this. Historical theft and recovery figures are from Chainalysis, TRM Labs, CertiK and court filings as cited. Hardware wallet loss estimates are disputed between sources and are given as ranges. The link between leaked exchange data and physical attacks is explicitly presented as unproven. The description of fully on-chain order books, including the public visibility of positions and liquidation prices, was verified against Hyperliquid's own documentation and its live public API. ApeX's architecture was verified against zkLink documentation and the deployed contracts. The forced withdrawal path covers collateral rather than open positions and has not been exercised in production on ApeX Omni.