Hack on Binance: how it affects users and what happens to their cryptocurrencies

Binance must contain the attack, protect the affected data and assets, and carry out legally required notifications. The specific obligations depend on which group entity provides the service, its European authorization, and the consequences of the incident. Since the specific attack has not been identified here, the following describes the assumption of an intrusion that compromises personal data, services, or customer funds.

1. Protect systems and preserve evidence

The response must include identifying compromised accesses, limiting propagation, preserving evidence, and determining which data, accounts, and assets are affected. When DORA applies, continuity and recovery plans must be activated, the incident recorded, and the involved technology providers reviewed as well. Outsourcing infrastructure or custody does not eliminate risk management obligations, as explained by Demócrata on DORA.

2. Notify data breaches according to the GDPR

If the attack compromises personal data, Binance must document the breach, its effects, and corrective measures. It must notify the competent data protection authority without undue delay and, where possible, within 72 hours from becoming aware, unless it is unlikely to pose risks to individuals. It can complete an initial notification later; it should not wait to finish the entire investigation.

When there is a high risk, it must also inform affected individuals without undue delay, clearly explaining what happened, possible consequences, measures taken, and a contact for inquiries. The AEPD reminds of these obligations. If the breach comes from a provider, they must notify the data controller so they can comply, as explained by the French data protection authority.

3. Apply DORA if it is an authorized provider under MiCA

DORA applies from January 17, 2025 to crypto-asset service providers authorized under MiCA. It requires detecting, classifying, and managing technological incidents; those classified as serious must be notified to the competent supervisor through initial communication and subsequent reports.

Classification considers factors such as affected customers, duration, losses, and service criticality. Besides informing, the entity must investigate the cause, recover services, and correct deficiencies. This financial communication does not replace GDPR notification. The Austrian financial authority outlines the DORA application framework.

4. Safeguard assets and attend to customers

MiCA requires protecting and separating customer assets from own assets, maintaining custody controls, and ensuring operational continuity. In the event of an attack, it is necessary to prevent unauthorized new transfers, preserve movements, and cooperate with the supervisor.

Affected customers must receive clear information about the impact on their accounts or services and the measures they should take. It cannot be stated that every hack automatically generates a full refund: liability requires examining the service, losses, and circumstances. Nor should a specific MiCA authorization of Binance be assumed here.

5. Determine which authorities must intervene

The competent financial authority depends on the entity and the State of authorization; it should not be automatically attributed to France or Spain. NIS2 only adds obligations if the entity or activity is included in its scope: DORA acts as a specific sectoral regime and duplicate notifications should not be presumed. If there are suspicious movements, anti-money laundering obligations must be activated and cooperation with competent authorities ensured.

Binance currently has shared leadership: Richard Teng and Yi He are co-CEOs, meaning they share the position of chief executive officer. Teng replaced Changpeng Zhao in November 2023; subsequently, the company announced the promotion of its co-founder Yi He to co-CEO, an appointment covered by Demócrata on December 3, 2025. Therefore, presenting Teng today as the sole top executive would be incomplete.

Richard Teng: from financial supervision to Binance

Teng's career combines auditing, financial regulation, stock market supervision, and crypto-asset business management. Before joining Binance, he developed much of his career in institutions in Singapore and Abu Dhabi. These are his main milestones:

• Early steps in auditing. He began his career at PricewaterhouseCoopers, known as PwC, before moving into financial supervision. This first stage appears in a profile of his career published on Binance Square.
• Monetary Authority of Singapore, approximately 1997-2010. He worked about thirteen years at the Monetary Authority of Singapore, the country's central bank and financial supervisor. He became Director of Corporate Finance, with responsibilities related to capital markets regulation.
• Singapore Exchange, around 2010-2015. He joined Singapore Exchange, where he held responsibilities for supervising listed companies and became Chief Regulatory Officer, the top regulation officer.
• Abu Dhabi Global Market, 2015-2021. He was CEO of the Financial Services Regulatory Authority, the financial services regulatory authority of this Abu Dhabi financial center. He remained approximately six years leading the organization.
• Joining Binance, August 2021. He joined as CEO of Binance Singapore. Later he assumed responsibilities over Asia, Europe, Middle East, and North Africa, until leading the company's regional markets outside the United States.
• Global leadership, November 2023. He succeeded Changpeng Zhao as Binance CEO. Since Yi He's appointment as co-CEO, both share executive leadership.

The corporate biography of Teng details his main previous responsibilities and education: a bachelor's degree in Accounting, with honors, from Nanyang Technological University, and a master's in Applied Finance, with distinction, from the University of Western Australia. Binance also published a presentation of his appointment in November 2023.

Yi He: co-founder and co-CEO

Yi He did not come to leadership from a supervisory body: she is a co-founder of Binance and has been part of its executive leadership since the company's launch. When announcing her promotion, the company highlighted her involvement in defining vision, culture, and business strategy, as well as her role in community growth and product innovation.

According to information published by Demócrata, the appointment formalized a leadership responsibility she already exercised within the organization. Teng described her promotion as a natural step, while Yi He highlighted her colleague's experience in regulated financial markets. Both placed responsible expansion, innovation, and user care among their priorities.

What distinguishes their profiles

The main difference lies in their previous experience: Teng brings a career focused on regulation and financial markets; Yi He brings continuity from Binance's founding and experience in its strategy, community, and products. The shared structure also appears in the December 10, 2025 information, which explicitly identifies Teng as co-CEO.

To operate legally in Spain, a cryptocurrency platform needs authorization according to the European MiCA Regulation and must comply with ongoing obligations for anti-money laundering, organization, security, and customer protection. It is not enough to incorporate a company or to have been listed in the former Banco de España registry. Specific requirements vary depending on the services and assets offered.

1. Authorization for specific services

The ordinary route is to obtain authorization from the CNMV as a crypto-asset service provider. An entity authorized in another European Union State may also operate through the corresponding European passport, allowing cross-border services after the required notifications.

Certain already regulated financial entities may use the notification procedure provided in MiCA, within the services allowed for their category. The authorization must cover exactly the activity: custody, exchange for euros, crypto-asset exchange, trading, order execution or transmission, transfers, placement, advice, or portfolio management. The CNMV explains these routes.

2. Organization and verifiable means

To obtain authorization, submitting an application is not enough. Among other elements, the following must be accredited:

• Business plan, corporate structure, and internal organization.
• Suitable administrators and executives, with sufficient knowledge and experience, and qualified shareholders meeting applicable requirements.
• Financial guarantees and adequate means for the requested services.
• Internal controls, risk management, conflict of interest policies, and supervision of outsourced activities.
• Secure technological systems, business continuity, and capacity to respond to incidents.

The CNMV has an authorization manual to prepare the file.

3. Anti-money laundering and traceability

The platform must implement controls required under Law 10/2010: identify and verify clients and beneficial owners, assess risks, monitor operations, apply enhanced controls when appropriate, and report suspicious operations to SEPBLAC.

It must also keep documentation, train personnel, and have responsible persons and internal procedures, with external review when mandatory. For transfers covered by European regulations, information on the originator and beneficiary must be collected and transmitted: this is the so-called travel rule.

4. Customer protection and ongoing compliance

Mechanisms are required to protect and separate customer assets, manage complaints, and provide clear information on prices, fees, and risks. Advertising cannot be misleading. Advice and portfolio management have additional requirements, and personnel must have appropriate competencies.

Authorization does not end compliance: supervision, reporting, and technological resilience obligations continue, including those under DORA, the European digital operational security regulation.

5. Activities requiring additional requirements

• Tokens that are financial instruments: are outside MiCA and may require authorization and compliance with investment services regime.
• Issuance of crypto-assets: may require a white paper and specific obligations. Issuing electronic money tokens is reserved for authorized credit or electronic money institutions, according to the Banco de España.
• Payments with those tokens: may require additional payment services authorization or collaboration with an authorized provider, as explained in its payment criteria.

As of October 2026, the transitional regime has ended. The most recent CNMV statement consulted places its end on June 30, 2026. Therefore, a historical registration in Banco de España or a pending application is not enough: authorization and its scope must be verified in the official CNMV and ESMA lists, following the CNMV notice.