On Thursday, 29 October, the world’s largest crypto exchange stopped being the world’s largest crypto exchange for about twenty minutes. Hackers pulled roughly $6.3 billion in crypto out of Binance, broke the record for the biggest theft of its kind in history and, along the way, handed Croatia’s crypto scene the most expensive advertisement for a MiCA licence anyone could have commissioned. Three days later, on Sunday 1 November, withdrawals reopened. In the first nine and a half hours customers took out $4.65 billion, deposited $1.01 billion, and the net outflow of $3.64 billion equalled 2.1 percent of the exchange’s total assets. At that moment, the public register of Croatia’s financial services regulator, Hanfa, still had no entry for Binance. That gap is worth more than every security brochure ever printed.
A job interview, then a conversation with the vault
According to Binance’s account of the incident, the attack did not begin on a blockchain or in some exotic decentralised application. It began as a job interview. A fake interview compromised a DevOps engineer’s laptop, gave the attackers access to an internal service container, and they then used the company’s internal AI tool to submit unauthorised withdrawal requests. In short, the largest heist in financial history started as a video call with a fake CV and ended as a payment order that looked as if it had been written from the inside. The mask was not worn by a robber. It was worn by a recruiter.
Binance says private wallet keys were not compromised and customer assets remained covered. By Tuesday the company had replenished about 95 percent of the stolen amount, roughly $6 billion, using its own money, the Secure Asset Fund for Users (SAFU), its futures insurance fund and its treasury. The remaining 5 percent consists of less liquid tokens that take longer to source in the required quantities. Tether and Circle froze more than $1.1 billion in USDC linked to the incident, and by Thursday evening crypto firms had frozen roughly $3 billion in total. The FBI attributed the attack to North Korea’s TraderTraitor group, the same unit it holds responsible for the $1.5 billion theft from Bybit in February 2025. Pyongyang routinely denies such accusations, which has become part of the genre.
The fake-interview detail is not just a curiosity for security bloggers. It shows that attackers no longer target blockchains; they target the people with access to systems. Crypto is, at the end of the day, software run by computers, and computers are run by people who occasionally open an attachment that looks “a little odd”. The biggest hack in history was not a nuclear strike on cryptography. It was social engineering with a firm handshake and a fake job offer.
The run for the exit and the mathematics of trust
When withdrawals reopened, the race every exchange dreads began: customers pulled $4.65 billion and deposited $1.01 billion in nine and a half hours. The net outflow of $3.64 billion represented 2.1 percent of $171 billion in total assets, based on Binance’s proof-of-reserves data from 28 October. The first phase restored withdrawals across 15 networks and assets, with the rest tested afterwards. Founder and former CEO Changpeng Zhao wrote on X that “98 percent choose to stay” and that trust is not earned by what is said in good times but by what is done in hard times. Whether or not the figure is precise or optimistic, the message is clear: the exchange survived the run, but the run was real.
The comparison with a traditional bank is imperfect but useful. In “It’s a Wonderful Life”, the problem is not that the money does not exist; it is that the money is tied up in loans. At a crypto exchange the problem is similar, except that loans are replaced by tokens and the teller window by an app that can process billions in three hours. The difference is that banks have deposit insurance and a lender of last resort, while a crypto exchange has a fund, a treasury and good intentions. Binance is large enough to be its own lender of last resort. A smaller exchange is not. That is the entire point of the licence.
Croatia’s empty spot in the register
The European Securities and Markets Authority’s interim register listed 392 authorised crypto-asset service providers on 30 October. No Binance entity appears on it. Binance withdrew its Greek licence application in June after Reuters reported that the Hellenic Capital Market Commission was set to reject it, and since 1 July 2026 a licence in one member state no longer opens the entire Union without approval. In other words, Croatian users still trading on Binance are using a platform that is not formally authorised to provide those services in the EU.
Hanfa has repeatedly said that crypto services in Croatia may only be provided by companies with authorisation and an entry in its register. The register is public and short: Electrocoin, which received the first licence on 9 April, White Tech, Bitblock and Digital Assets, while IN Kapital awaits completion of its court-register entry. Five domestic licences is not an impressive number for a country of 3.8 million, but five is more than zero, and zero was the norm until spring 2026. Supervision has not stayed on paper: in July Hanfa ordered Fima Plus of Varaždin to stop providing crypto services immediately and return client assets, because it had operated without approval from 1 July 2025 to 23 January 2026. Unauthorised operation carries fines of up to €5 million for a legal entity, within a range of 1 to 5 percent of total net revenue in the previous business year, and €7,000 to €25,000 for the responsible person.
MiCA is not a magic shield. A licence means the company has passed checks on capital, governance, segregation of client assets and complaints procedures. It does not mean the software is infallible, that hackers cannot steal money or that every withdrawal will arrive within five minutes. Binance demonstrated that at the highest possible cost: it was big enough to absorb the loss, but also big enough to be a target. A licence is a driving licence, not an airbag. Still, the difference between a registered and an unregistered provider is not cosmetic: with the former there is a regulator that can order the return of assets; with the latter there is a support email address and hope.
The same script, smaller amounts: Croatian victims
In the same week that the crypto theft record fell, Europol announced the results of an operation against an investment-fraud network with victims in more than 50 countries. Seven suspects were arrested, more than 100 servers seized and 17 locations searched in Albania, Cyprus, Finland, Germany, Kosovo and North Macedonia, with estimated damage above €4 million. The model is familiar: misleading ads promise quick profits from crypto, foreign exchange or stocks; personal data is sold to call centres; fake brokers push for ever larger deposits; the platform displays invented gains; withdrawal requests are delayed until contact stops. The investigation began in 2022 after a German couple reported that they could not withdraw their money.
Croatia is no exception. Earlier this week domestic media reported that scammers had extracted more than €100,000 from Croatian victims via Facebook, while a 71-year-old lost €5,000 to a fake crypto investment offer. Reports came from Varaždin and Šibenik. The psychological mechanism is identical to the one that made Binance customers withdraw billions in panic: numbers on a screen that the user does not control. The difference is that in one case the platform existed, had employees, a history and a proof of reserves, while in the other it was a PowerPoint presentation with a logo and a fake chart. The damage is real in both cases, and recovery is practically impossible in the second.
A country that owns crypto but lacks the infrastructure
Croatia ranks eighth in the European Union and twentieth in the world on the 2026 Cryptonomy Retail Index for the presence of crypto in everyday retail. A 2024 European Central Bank SPACE survey found that 13 percent of respondents in Croatia owned crypto assets, while a 2023 Eurobarometer found that 16 percent had held crypto in the previous two years. At the same time, BTC Map recorded only about ten merchants accepting crypto and eight ATMs in October. This is a country that owns crypto but does not use it: a national team with world-class players and no pitch to play on.
That is precisely why the Binance story matters more to the Croatian scene than it first appears. A domestic user who keeps funds on a large foreign exchange participates in a global risk but has no access to the domestic regulatory framework. When something goes wrong, Hanfa can act only against companies in its register. For the rest it can issue warnings, but it cannot order the return of assets, appoint a receiver or bring misdemeanour proceedings against a parent company abroad. The five domestic licences are therefore not a bureaucratic detail; they are the only part of the crypto scene on which a Croatian regulator can lay a hand.
What remains after the week
First, exchange risk is real even at the very top. Binance covered the loss because it could; a smaller exchange in the same position probably could not. Second, a licence is not immunity, but it is an address. Third, the Croatian register is public, short and verifiable in two minutes, which makes it the cheapest investment of the week. Fourth, self-custody is not a tattoo for crypto meetups but a consequence of arithmetic: if the key does not belong to the user, the assets are someone else’s liability. And fifth, tax rules do not recognise the excuse “it was on the exchange”. Capital gains on crypto sales are taxed at 12 percent if the sale occurs within two years of acquisition, while gains after two years are exempt; crypto-to-crypto swaps are not taxed, and transactions are reported through the JOPPD form. If assets disappear in a hack, no tax relief covers the loss. The tax administration does not accept an apology that the wallet belonged to someone else.
Binance will survive. Most of its users will survive too, including those in Croatia who stood in a virtual queue for withdrawals on Sunday. But the week in which $6.3 billion evaporated in twenty minutes will leave a mark that is not measured in the price of bitcoin, but in the question every serious client will ask before the next deposit: where is my money when the platform falls? Croatia does not yet have enough domestic answers to that question, but for the first time it has a register where the answer can be checked.
Market snapshot (4 November 2026, 10:00 UTC)
| Bitcoin (BTC) | $78,312 | +1.77% / 24 h | MCap $1.575 trillion |
| Ethereum (ETH) | $2,319.76 | +2.43% / 24 h | MCap $283.4 billion |
| Solana (SOL) | $93.08 | +0.86% / 24 h | MCap $54.9 billion |
| BNB | $701.30 | +0.69% / 24 h | MCap $92.2 billion |
| Total market cap | $2.62 trillion | BTC dominance 59.97% | 24 h volume $76.7 billion |
BNB responded to the largest crypto theft in history with a gain of less than one percent, roughly the reaction of a neighbour who hears that someone has been robbed and goes back to turning the meat on the grill. The market decided that Binance is big enough to survive, that North Korea is far enough away and that the story is over. Crypto history suggests such stories do not end when withdrawals reopen, but when someone next asks how safe everything that looks safe really is.
This content is informational and does not constitute investment advice. Market data from CoinGecko on 4 November 2026 at 10:00 UTC; incident, licensing and investigation details from public statements by Binance, the FBI, ESMA, Hanfa, Europol and domestic media.