The surface read of the Binance theft is reassuring. Binance says it has covered up to 90% of the roughly $6.3 billion in token assets stolen from its hot wallets, the largest crypto theft on record. Its statement is unambiguous about who bears the loss: Binance will absorb the financial impact of these stolen funds, not its users. A theft of that size, and the loss assigned to the company rather than its users. On that reading, the system worked.
It is worth slowing down on that. Nothing in the episode was a system. No insurer paid, no regulator ordered a payout, and no deposit scheme kicked in. A company decided to spend its own money, and it could. The useful question for an Indian reader is what happens when the company cannot, or will not.
The size of the cheque
Start with the scale. The previous record theft was the Bybit hack of February 2025, when the FBI said North Korea was responsible for the theft of approximately $1.5 billion USD in virtual assets. Binance's $6.3 billion is 4.2 times that.
A theft this size came with a promise to pay from the company's own funds.
Then the shortfall. If Binance has covered up to 90%, then at least 10% is not yet made good, which is about $630 million on a $6.3 billion loss. Binance says that remainder is in tokens that are less liquid, which means they may take longer to source in the required amounts. Even the unfinished part of the cleanup is a very large sum. Only a firm with a very large balance sheet can describe that as a logistics problem.
That is the point. The protection a user gets is not a feature of crypto exchanges. It is a feature of one exchange being very rich. The 90% is Binance's own account of its own coverage. It is a promise from the party with the strongest interest in keeping customers calm, not an audited outcome.
The same promise, a different path
India has a direct comparison. WazirX, an Indian exchange, also had to make users whole after a hack, and it did so through a court. Under the restructuring scheme reported in October 2025, hack victims get 85.5% of their portfolio value in cash or USDT within 10 business days of ratification. The remaining 14.5% arrives later as recovery tokens, and only if recoveries materialise.
Both exchanges promised users their money back. One paid from its own pocket, and the other needed a court.
The two percentages look close, and they should not be read as a ranking. Binance's 90% measures how much of the stolen assets it has replaced. WazirX's 85.5% measures how much of each victim's portfolio value is paid in cash or USDT. The gap that matters is in the route. One company chose to pay and said so. The other exchange's customers waited on creditor votes and a Singapore court process that, by October 2025, had produced a scheme passed by 95.7% creditor support in a revote after an earlier plan was rejected.
What Indian regulation does and does not do
A reader might assume India's registration regime fills the gap. It is worth being precise about what it covers. In June 2024, India's Financial Intelligence Unit imposed a total penalty of Rs. 18,82,00,000 on Binance, by an order dated 19 June 2024, and found the charges substantiated. Outlook Business reported the case turned on Binance not having registered as a reporting entity with the FIU, as the PMLA requires.
That regime has widened since. In October 2025, FIU-IND issued notices to 25 offshore crypto platforms, and MediaNama reported that 50 virtual digital asset service providers had registered by then. Offshore firms serving Indian users are expected to register too.
But look at what registration is. As MediaNama describes it, the requirement sits within India's anti-money-laundering framework, under the Prevention of Money Laundering Act. It tells the regulator who is operating and gives it a way to fine or block them. On the evidence of the order and notices cited here, it does not promise a depositor anything if the exchange is robbed. Nothing in them creates a fund, a guarantee or a payout rule. The Signal did not verify Binance's current registration status, and the argument does not depend on it.
The honest objection
The case against this reading is that the outcome is good, and that a market where large players self-insure may be a fine one. Exchanges that must pay for their own failures have every reason to guard their keys. A reader could add that Binance's customers were spared a long process, while an insurance scheme or a court would have taken far longer.
That case is real, and it explains why users may be right to prefer a large, well-capitalised exchange. But it describes this outcome, not the guarantee. The coverage is a company statement, and the remaining tokens are still being sourced. And the same arrangement that protected Binance's users in 2026 left WazirX's users in a court queue. If protection depends on the exchange being big enough to absorb the loss, it is not protection against the failure that matters most, which is the failure of a smaller exchange. Self-insurance works until the loss is larger than the insurer.
The Signal
The Binance theft is a test of crypto's oldest unanswered question, and the first answer is uncomfortable: the insurance policy on your exchange balance is the exchange. A record loss of roughly $6.3 billion was absorbed without users being asked to share it, but only because the firm that lost it could afford to say no.
For an Indian user, the practical test is not whether an exchange has registered. It is how large its loss cushion is against the worst theft it could suffer, and who is obliged to pay if the answer is not enough. Watch two things: whether Binance finishes buying the remaining tokens it has said it will cover, and whether India's rules ever add a payout duty to the registration duty. A guarantee is only worth the balance sheet behind it.
Reporting basis: the $6.3 billion loss, the 90% coverage figure, Binance's statements and the uncovered-token explanation are per CNBC, relaying Binance's own statements; they are company claims, not independently audited. The Bybit attribution is per the FBI's public service announcement on IC3, as also reported by NBC News. The Binance penalty amount and order date are per FIU-IND's own order, which was read directly; the reason for the penalty is per Outlook Business, reporting the order. The WazirX payout terms and creditor vote and the FIU-IND notices to 25 offshore platforms, along with the count of 50 registered providers, are per MediaNama's reporting (WazirX, FIU-IND notices), and each rests on that single outlet. The 4.2 times multiple and the figure of about $630 million not yet covered are The Signal's calculations from those figures.
