Cryptocurrency security: The risks, responsibilities and lessons for holders

The recent Binance hack has brought the security of digital assets back into sharp focus, highlighting the risks facing cryptocurrency exchanges and the people who rely on them to safeguard their funds.

Mario Rivas, Blockchain & Digital Assets Security Lead at NCC Group, breaks down what the incident could mean for cryptocurrency holders, the security controls that matter most, and what individuals should consider before moving or securing their assets.

How vulnerable are cryptocurrency platforms and digital assets to hacking?

"A platform holding digital assets should have multiple layers of security to prevent a single compromise, such as an employee’s laptop being hacked, from being sufficient to authorise a transfer. An attack of this scale raises questions about whether those controls failed, were bypassed or were not sufficiently independent.

At this stage, we can only speculate about exactly what happened within Binance. However, another major cryptocurrency theft illustrates the risks of compromised engineering access. In the February 2025 Bybit hack, attackers stole more than $1.4 billion after compromising a developer’s machine at Safe{Wallet}, the wallet software provider used by the exchange. The attackers altered the interface shown to Bybit’s signers, tricking them into approving a malicious transaction. While we should not assume the same happened at Binance, it demonstrates how attackers can undermine multiple approvals by compromising the system those approvers rely on.

Binance’s preliminary findings pointed to a compromised DevOps engineer’s laptop and access to internal services, while stating that it had found no evidence of wallet private-key leakage. Attackers do not necessarily need to steal a private key if they can make the legitimate system sign transactions on their behalf.

Despite the scale of the theft, only a portion of Binance’s custodied assets was affected. This highlights the importance of separating funds across hot and cold wallets to limit the impact of a compromise. The investigation should clarify how those controls operated in this case. The quick response and collaboration of organisations such as Tether and Circle also helped freeze some of the assets linked to the attack, although freezing does not mean they have already been recovered.

In our published research on custody architectures, we highlight the importance of identifying single points of compromise: components or privileged roles whose compromise could give an attacker control over funds. Protecting private keys is only part of that challenge; the systems that request and approve their use must also be secured. This is a central focus of our threat modelling and end-to-end security testing at NCC Group."

What does the latest hack mean for people who hold Bitcoin?

"People holding assets on Binance, whether Bitcoin or other cryptocurrencies, depend on the exchange containing the incident, covering the losses and restoring access to withdrawals. Binance has pledged to cover the losses, but that assurance should be distinguished from the completion of recovery and remediation.

Holders elsewhere can also experience losses through price movements, even if their own wallets are unaffected."

Should Bitcoin holders be moving their Bitcoin?

"There is no single answer for every holder. Self-custody reduces dependence on an exchange, but transfers responsibility for securing and recovering the assets to the owner. It introduces different risks, including compromised devices, tampered hardware wallets, lost recovery phrases and mistakes when transferring funds.

Moving assets only improves security if the destination and the process are safer. Rushing into an unfamiliar system without understanding how to secure it and recover access can make matters worse. For someone considering self-custody, understanding those responsibilities should come before moving substantial funds."

What security measures can people take to protect their cryptocurrency?

"The answer depends heavily on where the funds are held. For exchange users, protecting both the account and the associated email is essential:

• Use unique, strong passwords and phishing-resistant MFA, such as passkeys or security keys where supported.
• Verify destination addresses carefully and test unfamiliar withdrawal arrangements with a small amount first.
• Access the platform through its official app or a saved bookmark, rather than links in emails or social media.
• Be wary of convincing phishing attempts. Knowing your name, holdings or other private information does not make a caller or message trustworthy. Personal, accurate information can come from previous data breaches.
• Keep devices updated and limit unnecessary software. For substantial holdings, consider a dedicated device that is not shared or used for everyday browsing.
• Avoid publicly disclosing holdings or details that could make you a target.

For self-custody, protecting the recovery phrase and maintaining secure backups are critical. Never disclose it to someone claiming to provide support or rushing you towards performing actions you do not fully understand.

Strong account security helps prevent account takeover, but it cannot compensate for a breach inside an exchange’s custody systems."

How could the hack affect the value of Bitcoin? / How could the hack affect the wider cryptocurrency market?

"Digital asset prices are influenced by confidence in both the assets themselves and the ecosystem supporting them. A breach of this scale can trigger fear-driven selling and uncertainty over an exchange’s finances, potentially affecting holders well beyond the platform involved.

The wider impact will depend on how effectively Binance contains the incident, demonstrates that it can cover the losses and restores withdrawals. Prolonged disruption could also affect businesses relying on the exchange for trading or liquidity.

These are potential sources of volatility, rather than a basis for predicting a particular price movement."

Mario Rivas, Blockchain & Digital Assets Security Lead biography:

Mario Rivas is NCC Group’s Digital Assets and Blockchain Security Lead, specialising in the security of blockchain technologies and digital asset infrastructure. Based within NCC Group’s Security Consulting practice in Madrid, his work focuses on areas including cryptocurrency custody, private key security and the security architecture underpinning digital asset platforms.

He is an active security researcher and has published research on blockchain security, including NCC Group’s four-part series on private key security for blockchain operations and a technical analysis of the 2025 Bybit hack.