Introduction
According to Binance’s official statement of 30 October 2026, attackers compromised the exchange’s hot-wallet infrastructure at approximately 20:05 UTC on 29 October, resulting in unauthorized withdrawals of crypto-assets valued at approximately $6.3 billion. Binance initially identified a potentially compromised employee laptop as a possible entry point, although subsequent investigations revealed additional security breaches. At that stage, the company reported no evidence that wallet private keys had been leaked.
After the incident, Binance temporarily suspended withdrawals, strengthened its security controls, and began cooperating with law enforcement authorities, blockchain analytics companies, and token issuers to trace and freeze stolen assets. By 30 October, approximately $3 billion in affected assets had reportedly been frozen on-chain.
Binance pledged to cover the losses through corporate resources and its Secure Asset Fund for Users (“SAFU”). In its 1 November recovery update, the exchange reported that approximately 95% of the affected assets had been replenished. These figures describe the reported restoration of asset backing, not the completion of the investigation or the recovery of all stolen funds.
The central question raised by the incident extends far beyond any single exchange: who is responsible for crypto-assets entrusted to a custody provider, on what legal basis, and with what financial resources?
FTX: a different cause of loss, the same question of trust
The FTX crisis of November 2022 was different. Its primary cause was not an external hack but the misappropriation of customer funds. According to the United States Department of Justice, exchange founder Sam Bankman-Fried diverted billions of dollars in customer deposits to the affiliated trading firm Alameda Research. These funds were used, among other things, for investments, debt repayments, and other expenses. In March 2024, he was sentenced to 25 years in prison.
FTX demonstrated that a positive balance displayed on a platform does not, by itself, prove that the corresponding assets have been segregated and remain available for return. The Binance hack, by contrast, illustrates cyber and operational risk. Yet both cases raise the same question: are there formal arrangements to safeguard assets, control their use and hold intermediaries accountable?
MiCA compliance: why crypto-asset safeguards matter
In the European Union (“EU”), the Markets in Crypto-Assets Regulation (“MiCA”) establishes harmonized rules for certain crypto-assets and crypto-asset service providers (“CASPs”). Its core provisions governing crypto-asset service providers have applied since 30 December 2024. For businesses, the regulation introduces additional requirements concerning risk management, capital, process documentation and custody of client assets.
MiCA compliance requirements may appear costly, particularly in the early stages of a company’s development. Yet MiCA is not intended to eliminate every possible loss. Its purpose is to establish legal and organizational safeguards that strengthen client protection and define custodians’ responsibilities in advance.
What do Articles 70, 75 and 67 of MiCA actually require?
Article 70: safeguarding client crypto-assets and funds
Under Article 70(2) and (3) of MiCA, CASPs that hold clients’ funds other than e-money tokens must implement arrangements to safeguard clients’ ownership rights and prevent using such funds for their own account. These funds must be deposited with a credit institution or central bank by the end of the following business day and held in accounts separately identifiable from those containing the provider’s own funds.
Article 70(5) exempts CASPs that are electronic money institutions, payment institutions, or credit institutions from these requirements. These provisions address the risk of commingling client funds with a provider’s own resources.
Article 75: MiCA custody requirements and crypto custodian liability
Article 75 of MiCA specifically governs custody and administration of crypto-assets on behalf of clients. A custodian must establish a contractual relationship and provide information about the service, custody policy, security arrangements, fees, and applicable law. It must also maintain a register of positions for each client and record asset movements in accordance with established procedures.
Client asset segregation is a central principle: client crypto-assets must be legally and operationally segregated from the provider’s own assets. The custody policy must address appropriate controls and risks, including fraud, cyber threats and operational mistakes. If custody is delegated to another provider, Article 75(9) requires using a provider authorized under MiCA and requires that the client be informed of the delegation.
Article 75(8) is especially important: a custodian is liable for the loss of crypto-assets or the means of access to them where the incident is attributable to the provider. Such liability is capped at the market value of the lost crypto-assets at the time of the loss. Liability may not arise for an event unrelated to the provision of the service or the provider’s operations, subject to the regulation’s conditions.
This is no unconditional reimbursement promise. It does, however, provide a legal basis for assessing custodial obligations and the consequences of breaching them. Such clarity is as important to mature financial infrastructure as technical safeguards.
Clients should understand how assets are returned when service ends, including transfers to another custodian and evidence of ownership. Clear procedures do not eliminate risk but help allocate responsibility. Where several firms form a custody chain, clients need to know which entity is accountable to them and which provides infrastructure to another company.
Article 67: MiCA prudential safeguards
Under Article 67 of MiCA, a crypto-asset service provider must maintain prudential safeguards at all times, equal to at least the higher of two amounts: the minimum capital requirement applicable to the relevant services, or one quarter of the fixed overheads incurred in the preceding year. These safeguards may consist of own funds, an insurance policy, a comparable guarantee or a permitted combination of these instruments.
If a provider relies on an insurance policy, MiCA specifies requirements for that policy and the risks it must cover, including certain operational failures and applicable liability under Article 75(8). However, these provisions do not mean that every custodian is required to insure 100% of all client balances. Prudential safeguards, legal liability, and insurance protection are related but distinct mechanisms.
The Binance hack: why crypto-asset safeguarding must be established in advance
Binance announced its intention to absorb the consequences of the attack. This underscores the importance of an operator having the financial capacity to withstand a major incident. But such a public corporate commitment is not a substitute for statutory requirements concerning segregation of client assets, custodian liability and financial resilience.
This is where MiCA’s practical value becomes clear. The regulation cannot guarantee that hacks or poor business decisions will never occur. It requires service providers to establish custody procedures, respect clients’ rights and maintain specified financial resources in advance. As a result, earlier debates over whether MiCA was “excessive” now look different: the cost of compliance becomes part of the cost of earning trust.
Paycific and Manimama: planning a regulated crypto custody framework
Paycific, Manimama Law Firm’s digital-asset project, highlights the importance of reliable custody arrangements. Paycific focuses on over-the-counter cryptocurrency exchange services and cross-border digital-asset transactions.
At Manimama, we recognize that building a sustainable crypto business requires more than technological infrastructure. Legal compliance, regulatory clarity and the protection of client assets must be considered from the outset. These principles are particularly important when structuring custody arrangements, where the choice of service provider directly affects the legal safeguards available to clients.
As part of its planned custody infrastructure, Paycific intends to use solutions within the WhiteBIT ecosystem to safeguard clients’ crypto-assets. This approach is particularly relevant given recent regulatory developments in Europe. On 23 April 2026, the Croatian Financial Services Supervisory Agency (Hanfa) granted WHITE TECH d.o.o. authorization to provide crypto-asset services under MiCA, including the custody and administration of crypto-assets on behalf of clients.
According to WhiteBIT’s official announcement, WHITE TECH forms part of the W Group ecosystem, which also includes WhiteBIT. This authorization matters because it brings the licensed entity’s custody services within MiCA’s requirements for asset safeguarding, operational arrangements, and custodial liability.
For Paycific, integrating professionally managed and appropriately regulated custody services into its operating model represents an important step towards a more transparent and accountable digital-asset infrastructure. From Manimama’s perspective, this approach reflects a broader principle of responsible crypto-business development: client protection should be supported by clearly defined legal obligations, sound operational practices, and verifiable regulatory safeguards.
Conclusions
FTX and Binance illustrated two different threats: the misuse of entrusted funds and a large-scale cyberattack. Both events nevertheless remind the market that managing client assets requires more than technology; it also requires clearly defined legal rules.
MiCA establishes specific duties on asset safeguarding, segregation, custodian liability, and financial resilience. That is why requirements once viewed as a burdensome regulatory exercise now look like essential infrastructure for a mature crypto-asset market.
For clients, what increasingly matters is not the promise that “your funds are safe”, but the ability to verify who holds their assets, under which rules, and who is responsible if something goes wrong.
At Manimama Law Firm
Manimama Law Firm can help you assess your custody structure against MiCA custody requirements, review custodian liability and asset segregation arrangements, and identify regulatory risks before launching your service. Whether you are launching a new crypto project, selecting a custody provider, or adapting an existing business to evolving regulatory requirements, Manimama Law Firm can help you build a legally sound, sustainable operational framework.
Contact our team to discuss your business model.
Contact information
Leave a request, and we will assemble not just candidates, but a team that will work toward a common goal.
If you want to become our client or partner, write to us at support@manimama.eu.
Or use our Telegram @ManimamaBot and we will respond to your request.
Join our Telegram to receive news in a convenient way: Manimama Legal Channel.
Disclaimer: The information provided in this article is intended for general informational purposes only and should not be considered as individual legal advice. For legal assistance tailored to specific circumstances, it is recommended to seek professional legal counsel.
