Bitcoin’s Whitepaper Turns 18 as Binance’s $6.3 Billion Estimate Renews the Custody Debate
As Bitcoin’s whitepaper marks its 18th anniversary, Binance’s estimate that a wallet incident affected $6.3 billion in assets highlights the different risks of using Bitcoin’s payment network and trusting a company to hold crypto for you.
- The whitepaper proposed peer-to-peer payments verified without a central payment operator.
- Binance’s $6.3 billion figure is an estimate of assets affected, not confirmed losses.
- Self-custody puts key security and recovery in the owner’s hands.
- Third-party custody transfers key management to a provider, but not the risk of relying on it.
A payment network, not a guarantee about exchanges
Satoshi Nakamoto published “Bitcoin: A Peer-to-Peer Electronic Cash System” on Oct. 31, 2008. In its nine pages, the whitepaper proposed a way to make digital payments without relying on a trusted financial intermediary to verify each transaction.
The design broadcasts transactions publicly and uses proof-of-work to establish their order. Each full node checks transactions independently and follows the valid chain with the greatest accumulated proof-of-work. To rewrite an older transaction, an attacker would have to redo that work and catch up with the honest network. The security model depends on honest participants collectively controlling more computing power than any group of attackers.
The proposal explained how participants could verify payments and prevent double-spending without a central payment operator. It did not set rules for exchanges, verify their solvency or guarantee that customers would get their money back if a company failed or suffered a security incident.
That distinction matters when a crypto business is compromised. An exchange problem does not, by itself, mean Bitcoin’s network has been breached. Binance described an incident involving a hot wallet. The available details do not identify the affected tokens or networks, or point to a flaw in Bitcoin’s protocol.
What Binance has said about the incident
Binance said unauthorized withdrawals were made from a hot wallet on Oct. 29 and estimated that the incident affected $6.3 billion in assets. That is not a confirmed figure for assets stolen or permanently lost. The company said it was investigating multiple intrusion points and that investigators had found no evidence that wallet private keys were compromised.
On Oct. 30, Binance said it had set aside more than $6.34 billion to cover losses. It said more than $5 billion was already held in corresponding token assets, with the rest being purchased through market and over-the-counter channels. Binance said it would use its Secure Asset Fund for Users and company resources to cover losses.
These remain Binance’s estimates and assurances, not a final accounting. The available information does not establish the total losses, the full impact on customers or the investigation’s final findings. And the lack of evidence that private keys were compromised does not explain exactly how the unauthorized withdrawals were enabled.
Custody is about who controls the keys
Crypto custody comes down to who controls the private keys, the credentials that authorize transactions. A wallet does not literally hold bitcoin or other crypto assets. It holds the keys used to access and move them.
With self-custody, you control your own keys. That means less reliance on an exchange or another custodian, but you are responsible for protecting the keys and keeping recovery information safe. Lose that information, or let someone steal it, and you may lose access permanently.
With third-party custody, a provider controls the keys for you. That can make access easier to manage, but you depend on the provider’s security, practices and ability to keep serving customers. A hack, shutdown or bankruptcy could delay access or limit recovery. The outcome depends on the custody arrangements, contract terms and applicable law.
The SEC’s investor education office, in a December 2025 bulletin, outlines risks on both sides. It advises investors to ask custodians how assets are stored, whether customer holdings are combined or lent out, whether storage is subcontracted, what insurance covers and what fees apply. “We offer custody” does not answer those questions.
Hot and cold wallets are a separate distinction from self-custody and third-party custody. A hot wallet connects to the internet and faces greater exposure to online threats. A cold wallet is generally kept offline. Either type can be used in either custody arrangement, and cold storage does not protect keys from theft, loss or damage.
Control comes with responsibility
Casa chief security officer Jameson Lopp argued in an Oct. 22 letter that investors who use exchange-traded funds or managed custody still depend on institutions to safeguard their holdings. The trade-off is real: when a provider controls the keys, customers must trust its systems and conduct. Casa offers assisted self-custody services, so readers should weigh Lopp’s perspective alongside his professional role.
Self-custody is no safety spell. Owners must protect their keys and recovery arrangements from theft, accidental loss, device failure and bad backups. Third-party custody can provide operational support, but it cannot remove the risks of relying on a company.
Bitcoin custody: key questions
-
Did Binance confirm $6.3 billion in losses?
No. Binance estimated that the incident affected $6.3 billion in assets. The available information does not establish the final amount of any losses.
-
Does the Binance incident show that Bitcoin was hacked?
No. The available information does not support that conclusion. Binance described unauthorized withdrawals from a hot wallet, but the affected assets and networks have not been identified here.
-
What is the main risk of self-custody?
You control the keys and must secure and recover them. If they are lost or compromised, you may lose access to the assets.
-
What should I ask a crypto custodian?
Ask how assets are stored, whether they can be combined or lent out, whether storage is subcontracted, what insurance covers and what happens if the provider fails.
-
Does cold storage eliminate custody risk?
No. Keeping keys offline can reduce online exposure, but keys and recovery information can still be stolen, lost or damaged.
The whitepaper showed how to verify payments without handing the job to a central payment operator. It did not make custodial companies trustless. Self-custody puts responsibility on the owner, while third-party custody puts it on a provider. Neither choice makes risk disappear.
