David Marcus Links Binance Hack to Historical Security Flaws, Calls for New Controls
David Marcus, co-founder and CEO of Lightspark, detailed how the recent Binance hack echoes past security breaches in traditional finance, emphasizing the need for adapted controls in real-time settlement systems.
David Marcus, co-founder and CEO of Lightspark and former head of Meta’s crypto efforts, posted on X today, October 30, 2026, about the recent Binance hack.
The alleged Binance hack, which reportedly saw $6.3 billion stolen, prompted Tether and Circle to freeze $1.79 billion in stablecoins.
Marcus's analysis implies that the speed of modern payment systems, including blockchains and real-time fiat rails, necessitates a fundamental shift in security.
David Marcus, co-founder and CEO of Lightspark and former head of Meta’s crypto efforts, posted on X today, October 30, 2026, about the recent Binance hack. Marcus stated that the $6.3 billion loss at Binance was a result of compromised operational security, similar to past incidents in both traditional finance and earlier crypto events. He wrote, "Yesterday Binance lost ~$6.3B in what looks like the same way. A DevOps engineer's laptop, then a service inside the withdrawal stack, then withdrawals the signer approved because they came from a trusted source. Hot wallets emptied in under four hours. No key was stolen. Nobody broke cryptography or a ledger. They found someone with access and used the trust that came with it."
The alleged Binance hack, which reportedly saw $6.3 billion stolen, prompted Tether and Circle to freeze $1.79 billion in stablecoins. Recent Gokhshtein Media coverage reported on these frozen assets and the overall impact of the incident, which raised questions about crypto security and the role of stablecoin issuers in mitigating losses. The Crypto Fear & Greed Index currently sits at 30 (Fear), reflecting broader market apprehension.
Marcus's analysis implies that the speed of modern payment systems, including blockchains and real-time fiat rails, necessitates a fundamental shift in security. He suggests that controls must adapt to settlement in seconds, advocating for "Approval policy no laptop or vendor login can reach. Velocity and anomaly limits enforced outside the system that sends. Dynamic caps on what any one wallet, account or service can move per hour. All of it in real time." His view indicates that the challenge is not with the underlying technology but with operational security and how access is managed.
“In 2014 I went nearly a week without sleep. I was running PayPal and attackers were inside our corporate network. They'd compromised an eBay employee's laptop, got onto the VPN, taken over a domain controller and made themselves domain admins. eBay and PayPal were one company then, on one Windows network. They stole 145M eBay user records, then came for the segregated vault holding PayPal's card credentials. We fought them off. They never got in, but they got close. Too close. Yesterday Binance lost ~$6.3B in what looks like the same way. A DevOps engineer's laptop, then a service inside the withdrawal stack, then withdrawals the signer approved because they came from a trusted source. Hot wallets emptied in under four hours. No key was stolen. Nobody broke cryptography or a ledger. They found someone with access and used the trust that came with it. Banks get hit exactly the same way. 2016: attackers inside Bangladesh Bank used its own SWIFT access to send $951M of payment orders to the NY Fed. $81M was lost. The rest was held because an unrelated sanctions filter tripped on the word 'Jupiter'. That was luck, and it only worked because wires took days to settle. June 2025: an IT employee at C&M Software, which connects Brazilian banks to Pix, sold his credentials for about $2,700. Attackers used them to send fake Pix transfers out of six institutions' reserve accounts at the central bank. ~$140M in under three hours. August 2025: stolen vendor credentials at Sinqia, another Pix connector. ~R$710M out of HSBC and one other institution in a single afternoon. The central bank froze most of it, after it had already moved. Same attack every time. Speed is what changed. When settlement took days, a filter, a correspondent bank or someone in ops could catch a bad payment. Pix, FedNow, SEPA Instant and blockchains settle in seconds. Payment security was mostly built for the slow world. PayPal's card and user data survived 2014 because domain admin on the corp network couldn't unlock it quickly enough, and our alerting caught the unusual activity on the network. That's the model. Approval policy no laptop or vendor login can reach. Velocity and anomaly limits enforced outside the system that sends. Dynamic caps on what any one wallet, account or service can move per hour. All of it in real time. About $3B of what left Binance has been frozen, almost all of it stablecoins. The $1.4B in bitcoin is sitting in 19 wallets and nobody can touch it. I don't think that's the problem. For decades the ability to reverse a wire or a card charge let a lot of weak security slide. You either stop the transfer before it's signed or you eat the loss. Nothing about the technology failed here. The chains processed exactly the transactions they were handed. Binance's own systems handed them the wrong ones because an engineer's laptop was compromised. That's operational security. eBay in 2014, Bangladesh Bank and two Pix connectors all failed at it on their own rails. In 2014 the attackers never reached the vault. If they had, the fraud losses would have been the small part. PayPal existed so people could pay without handing their card details to every merchant on the internet. We held those details so they didn't have to. Losing them would have broken the one thing the company was built on, and I'm not sure we would have recovered. I expect blockchains and digital assets to become the standard way money moves. Every custodian of digital assets, or of fiat on a real-time rail, is in that position now. The controls have to adapt to settlement in seconds, crypto or not.”
The Gokhshtein Media Voices Desk covers what the people who move markets are saying — statements, predictions, and reactions from notable investors, founders, and policymakers. About this desk →
