Binance’s $6.3 Billion Hack – What ADGM and VARA Custody Rules Require, and What Is Not Yet Known About UAE Clients

Abu Dhabi’s financial regulator said on 30 October that it is “engaging closely with Binance and monitoring the incident” after about US$6.3 billion in digital assets was taken from the exchange’s wallets. The statement from the Financial Services Regulatory Authority (FSRA) of Abu Dhabi Global Market refers to unauthorised withdrawals of assets. It doesn’t say whether clients in the UAE were affected.

Key takeaways

What is known about the incident

Binance said the total impact was about US$6.3 billion and that it will cover the losses so that users don’t bear them. By 31 October it said it had covered up to 90% of the stolen assets, using its Secure Asset Fund for Users (SAFU), part of its futures insurance fund and its corporate treasury. The remaining 10% is in less liquid tokens. Binance’s first explanation was a compromised engineer’s laptop that let an attacker reach a service container and submit withdrawals, and that co-CEO Richard Teng later said the attack was more complex.

Binance began restoring withdrawals in phases on 1 November. It said net outflows were about US$3.64 billion that day, 2.1% of its roughly US$171 billion in assets, which cites Binance’s own post on X. The FBI has attributed the theft to North Korea, CNBC reported.

What the FSRA has said

The FSRA’s statement says it is aware of a security incident involving unauthorised withdrawals of assets at Binance on 30 October, and that protecting clients and supporting orderly markets remain its priorities. It names no Binance entity, gives no detail on custody and doesn’t mention the UAE.

Where UAE clients sit in Binance’s structure

In Abu Dhabi, the FSRA approved three Binance entities in December 2025, and Binance said its global platform began operating through them on 5 January 2026. Nest Exchange, the trading venue; Nest Trading, the broker-dealer; and Nest Clearing and Custody, a recognised clearing house that provides custody of digital assets. Binance’s launch announcement, says Nest Clearing and Custody acts as custodian of user digital assets, subject to limited exceptions. It doesn’t say which user groups were moved, and doesn’t mention UAE residents.

In Dubai, VARA’s public register lists Binance FZE as an active VASP licence holder (VL/24/04/001, issued 15 April 2024) for broker-dealer, management and investment, lending and borrowing, and exchange services including derivatives. Custody services aren’t among the listed activities. Binance said in June 2024 that it would move UAE residents’ accounts to Binance FZE. We found nothing since on how UAE residents’ assets are held today, and no VARA statement on the hack.

What the FSRA’s framework requires of a custodian

Under the FSRA’s virtual asset guidance (version of 10 June 2025), a firm that provides custody of virtual assets must follow the safe custody rules in Chapter 15 of its Conduct of Business Rulebook, read with Chapter 17. That means:

• Reconciling each client’s virtual asset holdings at least weekly and sending retail clients statements at least monthly.
• Never allowing a single party or signatory to authorise the movement, transfer or withdrawal of custodied assets, or to hold the only access to the private keys. Firms must also mitigate collusion between authorised signatories and report those controls to the FSRA.
• Keeping an up-to-date list of everyone who can view, initiate, authorise or complete a transfer.
• Having a written procedure for a suspected or actual hack, theft or fraud, including the ability to halt all further transactions in the assets immediately.
• Remaining fully responsible to the regulator if custody is outsourced.
• Having the amount of custodied assets independently verified at least annually.

The FSRA doesn’t require firms to carry insurance. It recommends that brokers and custodians take out asset protection policies covering, at a minimum, hot wallets. The guidance also notes, in a footnote, that clients of a custodial wallet provider may lose their assets if the provider is hacked.

Also, read How to Get a VARA Licence in Dubai – Requirements, Steps and Costs for Crypto Firms

What VARA’s Custody Services Rulebook requires

VARA’s Custody Services Rulebook applies to VASPs licensed for custody services. Among its provisions:

• Client assets are not the VASP’s own assets or liabilities, each client’s assets must sit in wallets holding only that client’s assets, and rehypothecation is prohibited.
• The custodian must be a separate legal entity from group members providing other virtual asset activities, with its own team.
• Providers must choose between hot and cold storage on a risk-based analysis, document how assets move between wallet types and have those transfers audited by an independent third party.
• Keys stored online must not be able to execute a transaction unless controls ensure that physical access alone isn’t enough. Providers must consider multi-signature arrangements and mitigate collusion risk among signatories.
• A lost or compromised key policy must cover recovering assets, timely communication with clients, cooperation with law enforcement and regulators and, where relevant, public disclosure of wind-down arrangements.
• Providers must reconcile each client’s positions and give statements at least monthly.

In the sections we read, neither VARA nor the FSRA sets a minimum percentage of assets that must be kept in cold storage.

What is not yet known

Binance hasn’t said which entity’s wallets were drained, whether any ADGM- or VARA-regulated client assets were among them, or how the 90% coverage maps to clients in each jurisdiction. The FSRA and VARA haven’t said whether they have requested incident reports or reconciliations. Binance has said it will cover all losses, and its claim that user funds are safe is its own.

FAQs

Editor’s Take: The FSRA’s custody guidance puts the burden on the firm’s internal controls: no sole signatory, a list of everyone who can move assets, a written hack procedure and the ability to freeze transactions immediately. Binance paused deposits and withdrawals, says it revoked the affected address authorisation and froze about US$3 billion on-chain, which are the kinds of steps that procedure describes.

Whether the controls in paragraphs 153 and 154 of the guidance applied to the wallets that were drained depends on which entity held them, and that is the detail Binance hasn’t given. Users in the UAE should check which Binance entity their account sits with, since the answer decides whether the FSRA’s or VARA’s rules apply to their assets.