On the evening of 29 October 2026, in about twenty minutes, roughly USD 6.3 billion left the hot wallets of the exchange Binance across ten blockchains. Nobody stole a private key. No smart contract had a bug. By the exchange’s own account, an attacker got onto an engineer’s laptop, from there into a service inside the exchange, and from there told the exchange’s signing system to sign withdrawals. It signed them. The exchange says every customer will be made whole, and stablecoin issuers froze about USD 3 billion within hours. It is still the largest theft the industry has seen.
If you hold a Clevor card, or are waiting for one, the natural question is whether this could happen to the money behind your card. The short answer is no, not this way, because there is no hot wallet behind your card. The longer answer takes five minutes, and it explains what you are actually holding.
What a hot wallet is
An exchange is a custodian. Your balance there is a row in its database. On the blockchain, the money behind everyone’s rows sits pooled in a handful of addresses. The addresses that pay out withdrawals have to be online all the time and connected to the withdrawal system, so that your withdrawal arrives in seconds at three in the morning. That is a hot wallet: many customers’ money in one pool, with its key online, next to a system that signs. Cold storage holds the rest, offline. The hot pool is still enormous, because customers expect instant withdrawals.
“Hot versus cold” is the usual way to tell this story, and it misses the point of October. The exchange had cold storage. The attacker took the hot pool, and the hot pool alone was worth more than most exchanges hold in total. The question that matters is not how much sits in cold storage. It is whether there is a pool at all, and whether the thing that signs for it can tell a good instruction from a bad one.
Where your money sits with a Clevor card
A Clevor card is a single secure chip in a standard card body, with no battery, no screen and no cable. Its blockchain side runs on C-WaaS, the blockchain-native card scheme built by Cryptnox, the company behind Clevor’s technology. It is shaped like a card scheme, not like an exchange account, and four things follow from that.
Where the money sits in a blockchain card scheme. Diagram from the Cryptnox analysis of the October theft.
1. Your funds sit at your card’s own address
Not in a Clevor pool. There is no issuer-side wallet holding everyone’s balance, so there is nothing to sweep.
2. The key that pays never leaves the card
It is created inside the card’s EAL6+ certified secure element and stays there. Your phone never holds it. Clevor never holds it. There is no copy on a server for an attacker to reach.
3. Two signatures, two parties
When you pay, Clevor’s issuing system checks the payment against your limits and the approved destination, then signs an authorisation. On its own, that authorisation moves nothing. Only your card, after verifying it and after your PIN or your paired phone, signs the payment that actually moves money. Neither signature alone is a payment.
4. Settlement is a plain transfer
The money goes from your card’s address to the merchant’s address, in a stablecoin, in seconds, as an ordinary blockchain transfer. No smart contract of Clevor’s sits in the path, so there is nothing to hijack. And on these rails there is no card number to copy, so nobody can pay online with your details.
The same attacker, inside Clevor
Give the attacker the same start: an engineer’s laptop, then a service inside Clevor’s systems. Suppose they reach the signing system and get it to sign authorisations for anything they like. They now hold signatures that move nothing.
To move your money they would also need your card to sign, physically present or acting through your paired phone, and your card signs only within your limits, only to approved destinations, only after your PIN or your phone. Their problem has changed from “sign a transaction” to “get every cardholder to tap for me, within limits, to approved merchants”.
The worst case is a bounded number of small, in-limit payments from cards in use at that moment, to destinations that are known and reachable, which Clevor can stop by blocking cards as soon as its monitoring fires. The October outcome needed a pooled balance under an operator’s key and a signer whose signature is the payment. Your card has neither.
What a card does not protect you from
Honesty matters more than reassurance, so here is the other side.
- A lost card with its PIN or your unlocked phone. The finder can spend what your limits allow until you freeze the card. Limits bound the loss; they do not prevent it. Freeze first and ask questions later: it takes seconds in the app, and your backup card restores access to the same funds.
- Stablecoin freezes. A stablecoin issuer can freeze any address, including yours. That is a property of the stablecoin, not of the card.
- An outage. If Clevor’s authorisation service is down, your card cannot pay until it is back. It fails in the safe direction, but it still fails.
- Nothing is unhackable. The claim here is narrower, and we think more useful: there is no single component behind your card whose compromise drains everyone.
What you can do today
- Try the app. The Clevor app for Android is live on Google Play, running on the Clevor test network. Install it, create your account and look around. Balances carry a “Testnet” badge and have no real value, and card activation needs a Clevor card. Thirteen short tutorials show every screen.
- Get a card. Cards go to the waitlist first, and the waitlist is where early access is announced.
- Read the full story. Cryptnox walks the October attacker through a blockchain card scheme step by step, sources included, in its analysis of the theft.
Questions cardholders ask
Is a Clevor card a hot wallet or a cold wallet?
Neither, in the exchange sense. The key that pays lives in the card and signs only your own payments, within your limits, when you tap. There is no pool of customer money anywhere, so there is no hot wallet to drain and no cold vault to trust.
Does Clevor hold my money?
Your funds sit at your card’s own blockchain address. Clevor’s issuing system authorises your payments within your limits; it cannot move your funds by itself, because every payment also needs your card’s signature.
What happens if Clevor itself is hacked?
An attacker inside Clevor could at most obtain authorisations, which move nothing without your card. The exposure is limited to small, in-limit payments from cards in use at that moment, to approved destinations, and Clevor can block cards the moment its monitoring fires.
What happens if I lose my card?
Freeze it in the app. A frozen card gets no authorisations, so it cannot pay anywhere. Your backup card gives you access to the same funds.
Related reading: Debit card vs stablecoin payments and the Cryptnox analysis of the October theft.