Do billion-dollar crypto hacks threaten the industry's mainstream ambitions?

Cryptocurrency has spent the past few years making considerable progress towards institutional acceptance. Bitcoin exchange-traded funds have opened the market to traditional investors, banks are exploring digital-asset services, and governments have begun establishing regulatory frameworks for parts of the industry. But a series of increasingly expensive security breaches at major exchanges is raising questions about whether that progress is translating into broader confidence.

The latest incident involved Binance, the world's largest cryptocurrency exchange, which suffered a security breach on October 29 that resulted in approximately $6. 3 billion worth of digital assets being stolen. Attackers compromised infrastructure used to authorise withdrawals, with Binance's initial investigation pointing to a potentially compromised laptop belonging to a DevOps engineer.

The exchange said it found no evidence that wallet private keys had been leaked. The incident followed a $388 million breach at Bitget in September 2026 and the $1. 5 billion theft from Bybit in February 2025.

The Bybit incident was the largest cryptocurrency theft on record at the time. The Binance breach subsequently surpassed it, highlighting the scale of the security failures confronting even the industry's largest platforms. The market reaction was immediate.

Bitcoin fell below $78,000, hitting its lowest level in six weeks after the Binance incident, while Ether reached a two-month low. Customers also withdrew billions of dollars from Binance after withdrawals resumed. Yet the price reaction and the scale of the theft do not necessarily establish how much confidence has been lost, or whether prospective investors are becoming less willing to enter the market.

The more consequential question is whether crypto's growing institutional legitimacy is developing alongside, or ahead of, the public confidence needed to sustain mainstream adoption. Are repeated security breaches creating a trust problem? Michael Tanguma, Co-founder and CEO of Bitcoin custody provider Onramp, said that the distinction between the underlying asset and the institutions holding it is central to understanding the problem.

"They (the hacks) are undermining confidence in intermediaries, which is not the same as undermining confidence in the asset," Tanguma said. He argued that people who haven't entered the cryptocurrency market may care less about whether Bitcoin's underlying network functions as intended than about finding a reliable place to hold their assets. "What they doubt is whether there is a safe place to hold it, and every breach confirms that doubt," he told Invezz.

The distinction is important for an industry that frequently separates vulnerabilities in exchanges and custodians from the technology underpinning individual cryptocurrencies. A compromised exchange wallet does not necessarily indicate a failure of the Bitcoin network. But that technical distinction may be less obvious to someone whose first exposure to digital assets is a headline about billions of dollars being stolen.

Bill Zielke, Chief Revenue Officer at BitPay, made a similar point. "If you lose money, you don't care which layer failed," he said, arguing that customers need to trust the companies holding their assets as much as the technology itself. "Repeated security breaches can undermine investor confidence, particularly with people who were already skeptical," he added.

Professor Iwa Salami, Professor of Financial Law and Regulation and Director of the Centre of FinTech at the University of East London, believes the consequences are unevenly distributed. "Retail confidence suffers most. Institutions are more resilient because they can choose what to touch," she said.

Institutional investors can set limits on their exposure, conduct due diligence and select regulated custodians. Individual investors generally have fewer resources and less negotiating power when assessing the security arrangements of an exchange or service provider. "Repeated hacks, exploits and collapses reinforce the view that crypto is a space where consumers bear losses with no recourse," the professor told Invezz.

Salami said recurring failures involving governance, key management and operational controls pointed towards shortcomings in the industry's regulatory framework rather than isolated incidents. The concern is not necessarily that every exchange breach will cause investors to abandon cryptocurrencies. It is that repeated incidents could reinforce existing doubts among people who have yet to become participants.

Are investors actually losing confidence? Establishing whether security breaches are causing a lasting deterioration in confidence is more difficult than tracking Bitcoin's price or measuring withdrawals from an exchange. Binance's experience offers an early indication of the distinction.

Customers withdrew a net $4. 72 billion from the exchange after withdrawals resumed following the October breach. That represented approximately 3% of the platform's assets, while Binance co-chief executive Richard Teng said on November 3 that customer inflows and outflows had largely normalised.

The exchange also said it had replenished 98% of the affected tokens, using its Secure Asset Fund for Users and other company resources to cover the losses. The outflows demonstrate that customers responded to the incident, but they do not establish a widespread departure from the platform or a lasting decline in confidence across the broader market. Nor do exchange withdrawals capture people who decide against buying cryptocurrency in the first place.

Research commissioned by the National Cryptocurrency Association and conducted by Harris Poll offers some insight into that group. Its 2026 Crypto Readiness Report surveyed 2,014 Americans who did not own cryptocurrency. It found that 43% cited concerns about security and fraud as a barrier to ownership, while 31% identified a lack of trust in crypto platforms.

A lack of understanding was the most commonly cited obstacle, at 48%. The survey was conducted between June 24 and July 1, before the Bitget and Binance incidents. It therefore provides a baseline for existing concerns rather than evidence that those particular breaches have reduced adoption.

Academic research also points to a relationship between trust and cryptocurrency participation. A study published in the Journal of Technology Transfer in November 2025 examined 1,519 individual investors across Denmark, Finland and Sweden. It found that people who trusted strangers in financial matters were more likely to hold cryptocurrencies and express an intention to do so in the future.

Ylva Baeckström, a Senior Lecturer in Finance at King's College London and one of the study's co-authors, said limited knowledge about digital assets could make it harder for investors to distinguish between an asset and the service provider through which they access it. "This muddles the difference between the asset value and the reliability of the service provider," she said. The research, however, was based on survey data collected in November and December 2022, shortly after the collapse of FTX.

It does not measure the effect of the recent exchange breaches on investor behaviour. HashKey Group's Tim Sun believes sustained participation provides a better measure of confidence than immediate price movements or withdrawals. "Market prices can rebound well before trust is repaired," he said.

He suggested that user retention, new-user onboarding, net capital inflows, and longer-term participation in digital-asset applications would provide a clearer picture of whether confidence is recovering. Wall Street is moving in. Is retail confidence keeping pace?

The apparent contrast between institutional participation and retail concerns is particularly relevant as the cryptocurrency industry becomes increasingly integrated into traditional financial markets. The introduction of spot Bitcoin exchange-traded products in the US in January 2024 gave investors access to Bitcoin through conventional brokerage accounts. Ether products followed, while subsequent changes to exchange-traded product listing standards widened the route for qualifying products backed by other digital assets.

The regulatory environment has also evolved. President Donald Trump signed the GENIUS Act into law in July 2025, establishing a federal framework for payment stablecoins. In October 2026, the Office of the Comptroller of the Currency issued a final rule implementing the legislation, covering requirements including reserves, redemption, risk management, and supervision.

The rule is scheduled to take effect on January 18, 2027. However, the broader regulatory picture remains incomplete. The CLARITY Act, which seeks to establish a wider market-structure framework for digital assets, failed to advance in the Senate earlier this year.

For Salami, the speed of product development has outpaced some of the safeguards supporting it. "Product access (ETFs, custody offerings, tokenisation pilots) has moved faster than the supporting infrastructure of standards, supervision and legal clarity," she said. That gap does not necessarily prevent institutional capital from entering the market.

Institutions can gain exposure through products and service providers that operate within familiar financial and regulatory structures. Sun argued that institutional investors do not need complete confidence in the wider cryptocurrency ecosystem to participate. "Institutional adoption of digital assets does not necessarily rely on complete trust in the broader crypto ecosystem," he told Invezz.

Through regulated custodians, asset segregation and limits on counterparty exposure, institutions can isolate some of the risks associated with holding and trading digital assets. But that transition can also create new vulnerabilities. As traditional financial institutions become gateways to digital assets, custody and operational risks could become concentrated among a smaller number of large providers.

Tanguma raised a similar concern, arguing that institutions will need clarity over what they legally own and how their assets are protected if a platform or custodian fails. The distinction also extends to how people use cryptocurrencies. Zielke said businesses could accept digital-asset payments through processors that convert receipts into local currency immediately, allowing merchants to serve crypto users without holding the underlying assets themselves.

"Taking a crypto payment is very different from keeping your net worth on an exchange," he told Invezz. That suggests adoption can advance through payments and regulated investment products even when concerns about exchange custody remain unresolved. What would it take to build confidence?

The debate ultimately extends beyond preventing individual security incidents. It concerns what happens to customers when a platform fails and whether they have enforceable rights to recover their assets. Salami argued that regulatory requirements should be based on the functions performed by digital-asset businesses, with clearer rules for custody, lending and trading.

She also called for stronger asset segregation, independent audits, cybersecurity testing and incident disclosures. She questioned the reliance on exchange-operated protection funds, arguing that such arrangements are voluntary and depend on the financial strength of the companies maintaining them. Most direct cryptocurrency holdings also do not receive the same statutory deposit protection available to eligible bank deposits or the brokerage protections provided by SIPC for qualifying securities and cash.

That leaves customers with a different set of protections from those available through traditional financial institutions. Tanguma argued that custody arrangements should avoid single points of failure, including systems that allow one compromised employee or device to authorise transactions. He advocated structures in which multiple independent parties must approve asset movements.

However, technical safeguards alone cannot resolve questions about legal ownership, compensation and responsibility. Sun argued that the industry's objective should be to protect customers even when individual institutions fail, rather than asking investors to place their faith in a particular company. "The ultimate objective should not be convincing investors that a specific institution is flawless, but rather building a resilient financial system where investor assets and rights remain well-protected even when individual institutions fail," he said.

Crypto's institutional expansion and its recurring security failures are not necessarily mutually exclusive. The industry can attract capital through regulated products while individual investors remain cautious about the platforms and services through which they access digital assets. Whether that divergence becomes a lasting obstacle to mainstream adoption will depend partly on whether the industry can demonstrate that customer assets, ownership rights, and avenues for recourse are protected when something goes wrong.

Institutional acceptance can open the door to a larger market. It does not, by itself, answer whether ordinary investors will feel comfortable walking through it.