A|N Advisory · Notes
The exchange is not the blockchain
October 2026
Every large loss in the history of digital assets has one thing in common. The protocol worked. A company did not.
Whenever digital assets make the front page for the wrong reasons, the same sentence appears: crypto has been hacked. It is almost never true. In twelve years, no major loss has come from a break in Bitcoin, Ethereum or any other large network. The ledgers executed validly signed instructions and recorded every one of them, which is why investigators could trace the funds afterwards. What broke, every time, was a company standing between the client and the network.
The pattern is remarkably consistent.
| Year | Counterparty | What failed |
|---|---|---|
| 2014 | Mt. Gox | Custody and controls at the then-largest exchange: roughly 850,000 bitcoin reported missing, lost over years and unnoticed. |
| 2022 | FTX | Governance and segregation: client assets used by an affiliated trading firm; a shortfall of about USD 8 billion. |
| 2025 | Bybit | Signing process: a manipulated transaction interface led authorised signers to approve a transfer of about USD 1.5 billion. |
| 2026 | Binance | Operational perimeter: by the company’s preliminary account, a compromised employee device gave access to internal systems; estimated losses above USD 6 billion. |
Four companies, four classic financial-services failure modes compressed into twelve years: weak custody, missing segregation, a signing process that trusted a screen, a perimeter breached through a laptop. Any bank’s risk committee would recognise every one of them. None is a technology problem in the sense the headlines imply.
Assets held at an exchange carry the risk of that company. Not the risk of the protocol.
An exchange is not “the blockchain”. It is a centralised intermediary. It takes client assets into custody, operates the wallets and the systems that sign withdrawals, runs the order book and sits between its clients and the networks. The networks are open and verifiable. The company is not — unless someone makes it so.
This matters because the sector talks a great deal about decentralisation while most of the value at risk sits with a small number of centralised counterparties: exchanges, custodians, stablecoin issuers, bridges. For an institution deciding whether to hold digital assets, the question “is the technology safe?” is the easy one. It has been answered, repeatedly, by the technology itself. The hard question is the old one: who am I facing, how are they governed, how are their keys managed, what sits on their balance sheet — and who has looked.
That is not a new discipline. It is counterparty due diligence, the thing every treasurer and every credit officer has done for a century. What is new is that an entire asset class spent its first decade behaving as if the question did not apply. Each incident in the table above was, in the end, a reminder that it does.
Capital does not follow conviction. It follows permission — and permission requires that the counterparty can be read. The networks have made themselves legible by design. The companies around them have not, yet. Closing that gap before the next headline, rather than after it, is where this market still has most of its work ahead.
Figures are approximate and drawn from public reporting at the time of each incident. The 2026 figures reflect Binance’s own statements and independent estimates as of 30 October 2026 and may change with the company’s technical post-mortem. Disclosure: the author advises Particula, a rating provider for digital assets.