Where digital asset custody meets board oversight.
Five Questions for Boards Overseeing Digital Asset Custody
The October incident was a sophisticated, state-linked attack on one of the industry’s largest operators. Its most useful lessons are not about any one firm but about how every institution entering digital assets governs custody at board level.
On the evening of 29 October 2026, around $6.3 billion was taken from Binance hot wallets across ten blockchains in a matter of minutes. The FBI has attributed the attack to North Korea’s TraderTraitor group, the same actor it linked to the Bybit theft in 2025. Binance covered affected client balances from its own funds, worked with law enforcement and began reopening withdrawals within days, while stablecoin issuers moved quickly to freeze stolen assets.
Investigations are still under way and no final root cause has been published, so this is not the moment for conclusions about any one firm. What the incident does offer is a clear scenario that every board overseeing digital asset activity can learn from.
A scenario boards can recognise
Binance has said no private key was leaked. Analysts including TRM Labs believe the attackers instead gained access to the systems that authorise transactions, so outgoing transfers carried valid signatures. On Ethereum, a feature introduced in a 2025 network upgrade appears to have been used to move a large balance in a single step.
Stripped of the technical detail, this is a familiar question for any financial institution: what happens if a trusted, privileged system is compromised? In its operational risk analysis of the incident, Metrika suggests this is the kind of scenario a bank would test, by asking how much value a single compromised authorisation path could reach before a control stopped it. That is a helpful framing for boards.
Why this sits on the board agenda
This is not only a technology matter. Under DORA, the management body bears ultimate responsibility for ICT risk and its members are expected to keep their knowledge current. The FCA’s operational resilience rules ask boards to approve important business services and their impact tolerances. MiCA makes crypto-asset custodians liable to clients for losses attributable to them, up to market value.
Few institutions could absorb a loss on this scale from their own balance sheet. As banks, asset managers and market infrastructures move into tokenised assets, stablecoin settlement and digital custody, these questions will increasingly reach their boards.
Five questions for boards overseeing digital assets
1. How much value could one authorisation path move before a control stops it? A clear answer, expressed as a number, gives the board a sound basis for setting limits.
2. Who approves how much is held in hot wallets? Online balances are a risk appetite decision, best weighed against capital, insurance and client liability.
3. Are transaction controls independent of the systems that initiate transactions? Policy checks that sit apart from the sending system are the digital equivalent of segregation of duties.
4. How are blockchain upgrades assessed? Network changes are effectively third party changes to the firm’s own infrastructure and benefit from the same change management as any other critical system.
5. How quickly can outgoing activity be paused, who decides and when was it last rehearsed? Speed of containment depends on decisions made and practised well in advance.
Building on what boards already know
None of this calls for new governance theory. Boards already understand limits, independent controls, change management, scenario testing and impact tolerances. The opportunity is to apply them explicitly to digital assets: in the risk appetite statement, in a clear approval route for new chains, tokens and custody models and in the annual scenario testing plan.
My whitepaper, Tokenisation at Scale™, argues that the decisive factors in institutional adoption sit below the asset layer, in operating models, controls and institutional architecture. This incident is a timely reminder that this architecture deserves board-level attention across the industry. Directors who start asking these questions now will be well placed as their institutions take their next steps into digital assets.
References
Metrika Team, Post Mortem: the Binance Theft Through an Operational Risk Lens (Part 1), 3 November 2026.Cointelegraph, Recap: how Binance’s record $6.3B hack unfolded, October 2026.Cointelegraph, EIP-7702 didn’t cause Binance hack, but may have amplified losses, 30 October 2026.Regulation (EU) 2022/2554 (DORA), Article 5: Governance and organisation.Regulation (EU) 2023/1114 (MiCA), Article 75: Custody and administration of crypto-assets on behalf of clients, ESMA Interactive Single Rulebook.Financial Conduct Authority, Operational resilience.
This article draws on public statements, media reporting and third party analysis available in early November 2026. Investigations are ongoing and Binance has not published a final root cause. Nothing in this article is intended as a finding on the conduct of any firm or individual. The views expressed are the author’s own.
© 2026 Gayathrisai Chandrasekaran
Lessons from the Binance Incident was originally published in Coinmonks on Medium, where people are continuing the conversation by highlighting and responding to this story.