The $6.3 billion hack of Binance has exposed a contradiction at the heart of cryptocurrency: the same centralization that helped make the theft possible also prevented billions of dollars from disappearing.

The exploit at the world's largest crypto exchange has revived a long-running debate over whether decentralization is the digital asset industry's greatest security advantage or its biggest weakness—one that permits irreversible transactions and leaves users dangerously exposed.

According to Binance's preliminary investigation, a compromised engineer's laptop was a major factor that may have allowed attackers to access the company's withdrawal infrastructure and initiate unauthorized transactions. The exchange said it found no evidence that private keys were compromised.

The incident nonetheless illustrates how centralized exchanges can become single points of failure. It is a familiar argument dating back to the 2014 collapse of Mt. Gox, which popularized the refrain “not your keys, not your coins.” The downfall of FTX in 2022 reinforced the appeal of self-custody, though that failure stemmed from the misuse of customer funds rather than a security breach.

Yet the latest episode also supplies a counterargument. Approximately $3 billion of the $6.3 billion affected has been frozen onchain, Binance said. Stablecoin issuers Tether and Circle used administrative controls to prevent USDT and USDC from being transferred. Those interventions were possible precisely because the tokens are not fully decentralized: their issuers retain the authority to blacklist addresses and immobilize assets.

Further details of the incident are documented in CoinDesk's coverage of the Binance hack.

The speed and scale of the intervention challenges one of crypto's defining assumptions: that transactions recorded on a blockchain are beyond the reach of any central authority. For assets with issuer-controlled restrictions, settlement may be final on the blockchain, but the ability to transfer those assets remains subject to administrative decisions.

That raises a broader question about the industry's architecture. If centralized intervention is increasingly regarded as an essential security feature rather than a compromise of crypto's principles, where does that leave decentralization as a defining objective for the sector?

The distinction is particularly stark when compared with native bitcoin and ether. Neither Bitcoin nor Ethereum has an equivalent issuer-controlled freeze mechanism, leaving stolen assets beyond direct administrative intervention even if their movements can be traced.

Freezing tokens does not automatically return them to victims, however, and the effectiveness of such measures depends on how quickly issuers act. Past episodes suggest recovery is rarely swift: the Mt. Gox bankruptcy estate began repaying creditors only about a decade after the exchange's 2014 collapse. The open questions are whether Binance's preliminary investigation yields further findings about how the engineer's laptop was compromised, and whether the frozen $3 billion can ultimately be returned to affected users—an outcome that would hinge on decisions by the exchange and the issuers involved rather than on any feature of the blockchains themselves.