Binance and Polymarket put their resources behind customer protection

Separate breaches at Binance and Polymarket on 29 October have prompted both platforms to promise protection for affected customers. Absorbing those losses can preserve the trading relationships that generate future revenue, but the protection depends on the financial capacity of the operator already under pressure.

The customer relationship is worth defending

Binance says attackers stole approximately $6.3 billion in cryptoassets from its hot wallets on 29 October. In its 30 October security update, the exchange committed to covering the losses through SAFU and company funds. It said it had prepared more than $6.34 billion in company funding and that approximately $3 billion in affected assets had been frozen through co-operation with industry partners. The investigation into how the attack was carried out remains ongoing.

In a separate incident that day, users of Polymarket's international prediction-market platform suffered unauthorised asset withdrawals following a third-party provider compromise. CoinDesk reported estimated losses of approximately $2.7 million, citing DeFi Llama. Polymarket's incident record confirmed the provider compromise, promised to make affected users whole and recorded the restoration of trading after an approximately one-hour outage.

These are different incidents with different loss mechanisms. Their commercial connection is the operators' commitment to absorb the financial consequences. The announced Binance funding remains a company statement rather than independent verification of its financial position, while frozen assets cannot yet be counted as money recovered. Both responses must ultimately be judged by delivery.

These businesses have strong reasons to fund compensation. Customers who associate a platform with an unrecovered loss have an immediate incentive to leave. Others may reconsider depositing assets or directing future activity through the service. Reimbursement addresses the financial injury around which that distrust can form.

For a trading venue, departures can have consequences beyond the loss of individual accounts. Where they reduce available liquidity, execution may become less attractive to remaining participants, giving further customers a reason to move. Absorbing a loss can therefore help defend the conditions under which the wider platform earns revenue.

This is the strongest argument for commercially motivated protection. A valuable continuing business gives its operator something to preserve, making customer compensation a rational investment in future earnings. That does not establish that reimbursement will retain customers after either incident. It explains why protecting them can serve the operator's interests as well as their own.

Protection has to earn its place in the business model

Exchange-funded protection has a longer history than the latest announcements suggest. Binance's account of SAFU dates its establishment to July 2018, when the company began allocating 10 per cent of trading fees to an emergency fund. Its May 2019 breach announcement said that the fund would cover the theft of 7,000 bitcoin in full.

The useful historical comparison is therefore about the strength and delivery of protection, rather than its recent invention. The present incidents do not demonstrate that exchanges collectively have become safer. They demonstrate the scale of responsibility particular operators are prepared to assume.

Funding that responsibility changes the economics of the service. Revenue retained against exceptional losses is unavailable for other purposes. An operator must balance resilience against lower fees, expansion and returns to owners. Protection carries a cost before customers receive any payment.

That creates a difficult pricing problem. Trading fees are visible during ordinary use, while the value of financial resilience becomes apparent under stress. A customer comparing venues may see the immediate saving from a cheaper service without being able to assess whether either operator could fund a major loss.

Credible protection could consequently support customer retention or institutional relationships without appearing as a separate charge. A venue might earn a return on that investment through continuing activity rather than a higher advertised custody fee. Whether customers reward it will depend on their experience and the evidence available to them.

Scale could help an operator build reserves and spread security costs across a larger revenue base. It also creates a larger business to defend. Neither advantage establishes effective governance, but both help explain why the ability to absorb losses could become a competitive asset.

The beneficiary is the operator that can substantiate its protection. A prominent promise whose scope or funding remains unclear gives customers much less to evaluate.

Self-custody answers a different part of the problem

The argument for keeping assets in a personal wallet remains relevant. Controlling the keys removes reliance on an exchange to authorise withdrawals and maintain access to those assets. It also places responsibility for securing that access with the holder.

The SEC's custody bulletin distinguishes self-custody from third-party custody separately from the distinction between hot and cold wallets. Either custody model can use online or offline arrangements. Holders managing their own keys face loss, theft and recovery risks; customers using a custodian depend on its systems and continued operation.

The comparison cannot therefore be settled by saying that personal wallets are always safer, or that reimbursement makes exchanges the safer choice. Security depends on the arrangement and its management. Compensation adds a possible recovery route after failure, which changes the financial consequences without removing the underlying exposure.

A holder using self-custody may avoid an exchange's collapse yet suffer an unrecoverable loss through compromised recovery information or a malicious transaction. A customer using a custodian may experience a breach and receive replacement assets. Those outcomes are possible because the models allocate control and responsibility differently.

Polymarket belongs in this discussion as an example of application risk, rather than as an identical custody case to Binance. Hudson Rock's investigation identified malicious code associated with a monitoring integration that sought access to authenticated trading and signing functions. Its analysis established the code's intended behaviour while leaving the full loss accounting unresolved.

That finding shows why control of keys cannot describe every risk incurred when using assets. Permissions and signing interactions can expose a holder to a compromised service. The financial relationship with the platform matters alongside the storage arrangement.

A reimbursement commitment offers customers a party willing to take responsibility for losses associated with that service. Its value comes from the resulting payment and remediation, rather than from any implication that the custody debate has been resolved.

Commercial discipline weakens when the operator is under stress

The incentive to protect customers works best when an operator has sufficient resources and expects a profitable future. A severe failure can put both conditions under pressure.

Compensation creates a demand for assets while investigation and service disruption consume resources. Customers may also seek withdrawals. The operator must fund its response at the same time that confidence in its business is being tested.

This is the central weakness of protection financed by the affected company. The resources supporting the promise and the incident generating claims are financially connected. If losses exceed the operator's capacity, the commercial benefits of reimbursement cannot supply the missing assets.

Solvency and immediate liquidity both matter. Assets that might eventually cover a liability do not necessarily meet an obligation falling due now. Customer protection therefore depends on the form and availability of funding as well as its stated value.

Eligibility determines how much of that capacity a customer can claim. Binance's SAFU terms reserve discretion over eligible losses, claims and management of the fund. Its existence should consequently be assessed alongside the terms governing access to it.

These arrangements can deliver worthwhile results without constituting a dependable industry-wide safety net. Successful compensation would demonstrate effective loss absorption by the particular operator. Calling it successful self-regulation across the market would require evidence of consistent standards and treatment, including when payment is contested or a business cannot continue.

Financial scale may consequently become an advantage in custody competition. An operator able to demonstrate loss-absorption capacity has another argument for retaining customer balances. Whether that translates into greater concentration or stronger pricing power will depend on customer behaviour, rather than follow automatically from these announcements.

Rights determine what survives a loss of confidence

Regulatory protection supplies a different basis for responsibility, although its scope varies by jurisdiction and service.

The Financial Conduct Authority explains that registration under the UK anti-money laundering regime does not itself provide customers with Financial Ombudsman Service or Financial Services Compensation Scheme protection. Registration should not be read as a general repayment guarantee.

In the European Union, MiCA's custody provisions require relevant providers to segregate client cryptoassets and establish liability for losses resulting from incidents attributable to them, subject to the regulation's conditions. Those obligations differ from insurance or a blanket compensation scheme.

It would therefore be inaccurate to present the latest commitments as proof that commercial incentives have replaced an absent regulatory framework. The obligations in either incident depend on the relevant entities, customers and services. A public promise alone cannot settle that legal position.

What the incidents do expose is the commercial value of accepting responsibility. An operator prepared to absorb losses can offer customers an outcome unavailable when nobody stands behind a failed transaction or compromised wallet. That can strengthen the case for using its service.

For Binance, the scale of the announced funding makes its delivery central to the credibility of that case. For Polymarket, replacing lost assets and explaining remediation will show how effectively the platform takes responsibility for dependencies within its trading experience.

Customers evaluating those responses need to distinguish an intention to pay from completed protection. The durable commercial advantage will belong to operators whose funding, terms and conduct make compensation credible before the next incident, including when preserving customer trust becomes expensive.

An exchange that wants customers to leave assets on its platform is selling continuing custody alongside access to trading. Its ability to bear losses belongs in the assessment of that service. So does the customer's position if those losses exceed what the operator can afford.

Sources

• Binance: Security incident update, 30 October 2026
• Polymarket: Incident record for 29 October 2026
• CoinDesk: Polymarket third-party breach
• Binance: SAFU history and funding
• Binance: Security breach update, May 2019
• Binance: SAFU terms
• SEC: Crypto asset custody basics
• Hudson Rock: Polymarket script investigation
• FCA: Cryptoasset registration and consumer protection
• ESMA: MiCA custody provisions