What the Largest Exchange Breach in History Did to Japan: Behind "No Impact on Customer Assets," Dependence on Offshore Liquidity Comes into Question

史上最大の取引所流出が日本に及ぼしたもの ― 「顧客資産に影響なし」の裏で問われる流動性供給元への依存

The Night JPY 1 Trillion Vanished in About 20 Minutes

On October 30 (JST), Binance disclosed that the impact of unauthorized outflows from its hot wallets was estimated at about $6.3 billion (about JPY 992 billion at 157 yen per dollar). TRM Labs valued the theft at $6.36 billion at the time of each transfer and found that most of the outflow was executed within roughly 20 minutes starting shortly after 5:00 a.m. JST on October 30, across ten blockchains led by Ethereum. The amount is more than four times the Bybit incident of February 2025 (about $1.5 billion), making it the largest single theft in the industry's history.

Binance's initial investigation indicated that a DevOps engineer's laptop was compromised and that the attacker reached a service container to submit unauthorized withdrawal transactions. The company stated there was "no evidence of a private key leak," but subsequently reported finding additional breach points and malicious software designed to erase evidence. On Ethereum, TRM Labs and other analysts believe the attacker abused the EIP-7702 delegation feature introduced in the May 2025 Pectra upgrade, taking control of a hot wallet through what appeared to be legitimately signed transactions. Both TRM Labs and Chainalysis attribute the attack with high confidence to North Korea's TraderTraitor group, though Binance itself has not identified the attackers and no government has issued a formal attribution.

Compensation, Freezes, and the Path to Reopening Withdrawals

Binance pledged that users would not bear the loss and earmarked more than $6.34 billion from its Secure Asset Fund for Users (SAFU), part of its futures insurance fund, and corporate treasury. As of October 30 it held about $5 billion (roughly 80% of the loss) in the same assets that were stolen, and by October 31 it reported having replenished 90% through market and OTC purchases. In parallel, about $3 billion was frozen on-chain, including more than 1.567 billion USDT by Tether and more than 800 million USDC by Circle. A freeze is not the same as recovery, however, and TRM Labs notes that the attacker still holds roughly $2.4 billion in ETH and BTC beyond issuers' reach. In its second update on October 31, Binance said it aimed to resume withdrawals in stages "within about 34 hours," pointing to the afternoon of November 1 JST. A proof-of-reserves snapshot was taken at 00:00 UTC on October 31, with results expected between November 2 and 3.

Japan's First Response: Segregation Worked

Regulated Japanese exchanges responded quickly and in near-unison. On October 30, Binance Japan announced it would keep trading open while suspending all crypto deposits and withdrawals, and that no impact on customer assets had been confirmed. Crypto deposits, trading, and yen deposits and withdrawals have since returned to normal, with only crypto withdrawals still suspended. bitFlyer restricted crypto transfers to Binance accounts until safety could be confirmed, explaining that customer crypto is held in cold wallets isolated from the network and segregated from corporate assets. bitFlyer Holdings CEO Yuzo Kano noted that Japanese law requires at least 95% of customer assets to be held in cold storage under strict segregation, and said customer asset safety was unaffected. SBI Holdings disclosed the same day that its subsidiaries' exposure to Binance was limited and that there would be no impact on consolidated results; SBI VC Trade and bitbank also reported no impact on customer assets. Bitcoin treasury company Metaplanet stated that all of its bitcoin is held in cold storage with a regulated top-tier custodian. At the time of research, no official comment on the incident could be confirmed from the Financial Services Agency or the Japan Virtual and Crypto assets Exchange Association (JVCEA), nor could specific responses from other major operators such as Coincheck, GMO Coin, or OKJ be confirmed in press coverage.

The Structural Risk That "No Impact" Does Not Address

Japan's initial response shows that the segregation and cold-storage obligations built up since the 2018 Coincheck incident functioned as intended. But that only means customer assets were safe; it does not change the fact that price formation in Japan depends on Binance's order book. India's CoinDCX, citing disruption at a "global liquidity provider," switched its futures market to reduce-only mode and halted new positions. The firm had been streaming Binance's order book to source liquidity for USDT-margined perpetuals. Japanese exchanges have not announced comparable measures, but much of the domestic order book tracks offshore prices through cover exchanges and market makers. A prolonged Binance withdrawal halt would be passed on to Japanese users as severed hedging routes, wider spreads, and stalled cover trades. Bitcoin briefly fell about 6% to the $76,000 range after the incident, and in the U.S., Coinbase dropped more than 10%, spreading the shock to equity markets. The defensive line of "where assets sit" held; "where prices are made" remains offshore.

[Business Development Insights]

The competitive axis for Japanese exchanges will shift from "customer asset safety" to "diversification of liquidity sources." Operators that can make visible their cover-venue concentration, connections to alternative liquidity providers, and procedures for maintaining order books when an offshore giant halts will more easily win trust from corporate clients and listed-company treasury teams. Infrastructure businesses that support redundancy in liquidity routes face clear demand.
Signing-infrastructure security has broadened from private-key custody to defending "the entire system that produces signatures." Attacks that abuse legitimate features such as EIP-7702 cannot be stopped by HSMs or multisig alone; independent policy evaluation, destination whitelists, and delegation-code monitoring are value-added areas that validator operators and custody providers can deliver.
The effectiveness of issuer freezes (about $3 billion) reaffirmed that stablecoin "freeze authority" works as a crisis safety net. Businesses designing yen stablecoins or trust-type tokens in Japan can gain an advantage in dialogue with financial institutions and regulators by building transparent freeze criteria and procedures into product specifications.

[Sources]

Supervisor

Akihisa Ishida

Cabinet Inc. Founder CEO

Since 2017, He has been consistently engaged in token and NFT utilization, blockchain game planning and development, and NFT-based business development. Having contributed to over 80 blockchain products—including projects for major entertainment companies listed in Tokyo Stock Exchange —He has served in various key roles such as Business Lead, Designer, PM, and Advisor. In 2021, founded Cabinet Inc.

Disclaimer

This report has been prepared solely for informational purposes regarding crypto assets and related markets, and is not intended to recommend, solicit, or offer the purchase, sale, holding, or any other transaction of any specific crypto asset. It does not constitute investment advice, investment solicitation, or the sale or intermediation of financial products as defined under the Financial Instruments and Exchange Act or any other applicable laws and regulations, nor does it constitute tax, legal, or accounting advice.

The information contained in this report is based on sources believed to be reliable at the time of preparation; however, we make no representation or warranty, express or implied, as to its accuracy, completeness, timeliness, or usefulness. Crypto assets are subject to significant price volatility and may result in the loss of principal or other financial losses. Any investment decision shall be made solely at the user's own discretion and responsibility, and we accept no liability whatsoever for any damages arising out of or in connection with the use of this report.

Blockchain Business Consultation

From idea-stage brainstorming and technical validation (PoC) to implementation and operations, Cabinet provides end-to-end business development consulting. Start with a free consultation today.

← Previous Article

gumi Shuts "Yosoku Hiroba" Five Months After Launch: Why a Free, Points-Based Prediction Market Built to Avoid Gambling Law Could Not Survive in Japan

Sign Up for Newsletter

Beyond the content of this report, we will deliver the latest industry information and exclusive reports by email.