Exchanges got hacked. Bitcoin didn't

The Roundup is Rhino’s weekly read for people who’d rather build a process than predict a price.

In what has been deemed the largest crypto theft in history, last week attackers got away with around $6.3 billion from the world’s most popular cryptocurrency exchange, Binance. Bitcoin dropped about 6% on the day and is now trying to find its footing around $76,000. 

We’re not here to grill Binance while the dust is still settling. We’re here for the lesson, because it’s one that Bitcoin has now taught three times this year.

That lesson is that Bitcoin itself wasn’t hacked — Binance was. 

Although we don’t know the details of the attack just yet, we know the Bitcoin network itself wasn’t affected. In fact, the people who lost money weren’t actually holding Bitcoin; they were holding an IOU from an exchange. 

So this means we should all run to self-custody, right? Not so fast. Holding your own keys isn’t the silver bullet, especially with some of the attacks that have happened this year. 

Coldcard users had around $130 million in Bitcoin stolen. Ledger discovered that an authorized third party vendor had implanted spyware into their devices to steal private keys; there has been a data breach at Trezor, and Keystone is destroying around 18,000 hardware wallets after hackers stole device verification keys. 

All the flaws are different, but one lesson has stuck with us: a single hardware wallet in a drawer is its own single point of failure. Lose it, break it, get unlucky with a firmware flaw, or buy from a compromised vendor, and you might find yourself exposed. 

One option out is multisig. Instead of one key, your Bitcoin is spread among  several different devices and locations — so you are less vulnerable to a single break. Services like Casa make this genuinely usable for normal people. They walk you through setting up the keys, spread them across your phone and a hardware wallet or two, and hold one emergency backup key themselves that is activated only at your behest with some passwords of your choice. 

But, crucially, they can never move your Bitcoin on their own. And because spending takes more than one key, losing a single one isn’t the catastrophe it would be with a lone wallet. You could just swap out that key.

While multisig is the most accessible route, it’s not the only one. Bigger holders also use multi-institution custody (MIC) — keys split across several independent companies, so that none can act alone — or insured custody, where the coins are held under a policy that pays out if something goes wrong. Onramp and AnchorWatch are at the forefront of MIC.

The hacks aren't going to stop. $6.3 billion last week, Coldcard and Ledger before it. The only question is when the next one hits, is your Bitcoin sitting behind just a single vulnerable door?

Stop betting everything on one device and make sure your Bitcoin stays protected.

Talk next week,

The Rhino Research Team