Binance reported a security incident with an estimated total impact of around $6.3 billion and reserved company funds to cover the loss. Binance has attributed the initial access to a compromised DevOps engineer's laptop that permitted unauthorized withdrawal transactions from a service container. TRM Labs has publicly attributed the attack with "high confidence" to a North Korea-affiliated group. This is not the first time an exchange has been hacked.
A trading venue or exchange holds customer assets to facilitate trading, typically in pooled wallets with operational hot-wallet access, and the customer's claim in a failure is shaped by the venue's terms and insolvency regime. A US spot crypto ETP or ETF is not structured as a venue customer. Shares are issued by a trust or registered fund that holds the underlying asset through a qualified custodian that is regulated by state or federal agencies, with creations and redemptions processed through SEC-regulated entities known as authorized participants.
- Qualified custodian requirements. For registered ETFs, Section 17(f) of the Investment Company Act of 1940 and Rule 17f-1 restrict who may hold fund assets. For advisers, the custody rule (Rule 206(4)-2 under the Advisers Act) requires client funds and securities to be maintained with a qualified custodian, supported by account statements and independent verification. These rules exist to keep assets with regulated, financially responsible institutions that are separate from the manager.
- State trust companies. On 30 September 2025, the SEC staff issued no-action relief under which advisers and registered funds may treat certain state trust companies as "banks" for crypto custody, subject to conditions including state authorization to custody crypto, segregation of client assets, audited financials and SOC reporting, and disclosure of material risks (to boards, in the case of funds). This is staff relief, not a rule, and it does not amend the statutory definition of a permissible custodian.
- Segregation and property-law treatment. Institutional custody agreements typically require client assets to be segregated from the custodian's own assets and from other clients, held at identifiable addresses, so that the custodian is a securities intermediary rather than a debtor holding commingled claims. In a custodian insolvency, that treatment is designed to support entitlement-holder rights rather than unsecured creditor status. The SEC's October 2026 proposal itself relies on this construct for self-custody.
The reported Binance incident is a reminder that where and how crypto is held matters as much as which asset is held. Registered vehicles such as US spot crypto ETPs and ETFs are built around qualified custodians, segregation of client assets, independent verification, and regulated creation and redemption processes. These features can give investors stronger legal protections than an account at a trading venue, and for many investors may make an ETF or ETP the better way to gain crypto exposure. However, please keep in mind that no structure eliminates risk: investors remain exposed to price volatility, and custodians and funds can still face operational and security failures.
.svg)