On 29 October, hackers stole around US$6.3 billion from Binance, the world's largest crypto exchange. It's the biggest crypto theft on record, and it didn't start with a clever attack on bitcoin. It started with one compromised work laptop.

In this article we cover what happened, what it meant for markets, why we're not concerned about the Kōura Bitcoin Fund, and six simple habits that help keep your own savings safe online.

What happened

Late on 29 October, hackers drained around US$6.3 billion from Binance in a little under four hours. That's about four times the previous record, the US$1.5 billion Bybit hack in February 2025.

Binance's early findings point to a compromised laptop belonging to one of its engineers. From there, the attackers reached Binance's systems and made unauthorised withdrawals. The attack has been linked to North Korea, and it follows the same pattern as a number of other recent crypto hacks.

Binance responded quickly. It paused deposits and withdrawals, said it will cover all customer losses, and started working with stablecoin issuers and blockchains to freeze stolen funds. About US$3 billion had been frozen within a day.

What it meant for markets

The hack knocked roughly US$100 billion off the value of the crypto market, which fell from nearly US$2.7 trillion to below US$2.6 trillion. Bitcoin fell about 5.5% on 30 October to around US$76,000 and finished October down 7.4%, at about US$77,000. Ether and Binance's own coin, BNB, fell further, and shares in US exchange Coinbase dropped 14%.

Investors also pulled money from bitcoin funds. US spot bitcoin ETFs (funds that hold actual bitcoin) saw a net US$643 million go out on 30 October.

We've been here before. After the collapse of the FTX exchange in 2022 and the Bybit hack in 2025, bitcoin fell sharply, then recovered within a few months.

Past performance isn't a reliable guide to the future, and there's no guarantee bitcoin will follow the same path this time. But it's a useful reminder that these shocks have tended to hit confidence harder than they hit bitcoin itself.

What it means for the Kōura Bitcoin Fund

The most important point: bitcoin itself wasn't hacked. A crypto exchange was.

The Kōura Bitcoin Fund doesn't hold bitcoin on an exchange like Binance. We invest through funds run by BlackRock and Fidelity, two of the world's largest asset managers. Those funds keep their bitcoin with large regulated custodians, in segregated accounts with the keys stored offline ("cold storage"), away from the kind of systems the hackers got into at Binance. The BlackRock and Fidelity bitcoin funds didn't lose any bitcoin in this hack.

While nothing is certain, we don't think you can get stronger or more reputable counterparties. In our opinion, BlackRock and Fidelity will not risk their businesses by letting customers lose on bitcoin.

The fund does still move with the bitcoin price. When bitcoin fell after the hack, so did the value of the fund, even though the bitcoin it holds wasn't at risk from the hack itself. Bitcoin is a highly volatile investment and isn't suitable for everyone.

Six ways to stay cyber-safe

The Binance hack started with one compromised laptop. Once the attackers were inside that device, they could get into the systems behind it. The same thing can happen with your personal accounts, so here are six simple habits that make a big difference.

1. Keep your devices up to date. Install software updates on your phone, laptop and tablet as soon as they come out. Many updates fix security holes that attackers already know about.
2. Use strong, unique passwords and a password manager. A long passphrase made of several random words is stronger than a short, complex password. Avoid reusing passwords, especially for your email, banking or KiwiSaver. A password manager remembers them for you.
3. Turn on two-factor authentication (2FA). This adds a second check, like a code from an app or a text, when you log in. Even if someone steals your password, they can't get in without that second step. Start with your email, because whoever controls your email can usually reset everything else.
4. Be suspicious of unexpected messages. Most hacks still start with an email, text, phone call or social media message that tricks someone into clicking a link, opening an attachment or handing over a code. Scammers often pretend to be organisations you trust, including KiwiSaver providers, and sometimes the people who run them. Watch out for:
   • messages that create urgency ("act now", "your account will be closed")
   • requests for your password, a 2FA code or bank details
   • links or email addresses that look slightly off, such as a misspelt company name
   • offers that seem too good to be true

   What to expect from Kōura: Kōura won't ask you for your password or a 2FA code. Rupert and the Kōura team don't contact members with special investment offers, guaranteed returns or "exclusive" crypto opportunities. If a message claims to be from Kōura or Rupert and something feels off, don't click any links or reply. Log in through our website or app directly, or call us on 0800 527 547 to check.

5. Watch out for "recovery" scams after big news. After a major hack, scammers move quickly. They pose as exchanges, investigators, lawyers, government agencies or "fund recovery" services and offer to get people's money back, usually for an upfront fee or in exchange for personal details. Some even target people who weren't affected, hoping to catch them off guard. Legitimate organisations don't contact you out of the blue asking for payment to recover funds.

   What to expect from Kōura: Your Kōura Bitcoin Fund investment was not held on Binance, so there is nothing to recover. Kōura and Rupert won't email, text or call you offering to recover funds, move your money somewhere "safer", or charge a fee to protect your savings. Any message like this is a scam, even if it uses our name or logo.

6. Be careful what you install and where you log in. Only download apps from official app stores. Avoid logging into financial accounts on public or shared computers, or on public Wi-Fi without protection.

The bottom line

As AI makes cyber attacks harder to stop, we expect to see more hacks like this one. The Binance hack shook crypto markets, but bitcoin itself wasn't hacked, and the Kōura Bitcoin Fund holds its bitcoin through BlackRock and Fidelity rather than on an exchange.

The bigger lesson is a personal one. It only took one compromised laptop to cause the largest crypto theft in history. Keeping your devices updated, using strong passwords and 2FA, and pausing before you click are some of the best ways to protect your own savings.

If you have any questions about your Kōura KiwiSaver account, get in touch with our team on 0800 527 547.

Disclaimer:
Cryptocurrencies are highly volatile and not suitable for all investors. 
Before investing part of your KiwiSaver balance in cryptocurrency, ensure 
you fully understand the associated risks: https://shorturl.at/U6Mkp.  
and/or consider seeking financial advice.