Floin Cyberattack: MiCA Crypto Platform From Liechtenstein Goes Offline

Floin, a crypto platform based in Vaduz with a MiCA licence from Liechtenstein's Financial Market Authority FMA, says it has been the target of a cyberattack. On Saturday, 31 October 2026, Floin took all of its services offline: the app and the web platform are unavailable until further notice. In an email to customers sent at 10:54 UTC, the company warns users not to send anything to Floin wallet addresses, even if deposits are still technically possible. Floin has not said whether any customer funds were lost.

Key facts

• Incident: cyberattack according to Floin, customer email on 31 October 2026 at 10:54 UTC, app and web platform offline since.
• Warning: no deposits and no crypto assets to Floin wallet addresses, including from external wallets or other exchanges.
• Damage: by Saturday afternoon Floin had named neither an amount nor the affected coins.
• Supervision: MiCA authorisation from the FMA Liechtenstein since 10 June 2026, valid in all 30 countries of the European Economic Area.
• Deposit insurance: the €100,000 statutory deposit guarantee does not cover crypto assets; MiCA requires segregated custody and liability up to market value instead.
• Hack wave: the second incident at a centralised platform within 48 hours, after the Binance hack of 29 October with about $6.3 billion in losses according to Binance.

Floin cyberattack: what the platform tells its customers

The notice is short and leaves the key questions open. Floin writes that the platform was the target of a cyberattack, that all platform services have been taken offline and that access to the app and web platform is therefore unavailable until further notice. The investigation is ongoing and has the highest priority. The status page has listed the incident as “Investigating” since 10:30 UTC, and a banner on the homepage of floin.com shows the same notice. CryptoTicker has seen the email.

Three sentences matter for customers. First: no deposits into Floin wallets, not even from external wallets or other platforms, explicitly “even if deposits are still technically possible”. Second: Floin is currently not answering individual enquiries, including emails. Third: updates will only be published on its own website, and customers should check it daily.

It remains open when the attack began, which systems are affected, whether coins or customer data were taken and when withdrawals will work again. Anyone who still sends coins to a Floin address currently has no one to contact who could match them to an account.

Who is behind Floin: a MiCA crypto platform from Vaduz

The platform is operated by Floin AG, Am Schrägen Weg 2, 9490 Vaduz, founded on 29 January 2021 as The Finest Token AG and entered in the Liechtenstein commercial register under FL-0002.652.200-0. According to the imprint, the founder and CEO is Marc Weber. Under the share prospectus of 30 June 2026, he holds 90.01% of the capital; the remaining 9.99% belong to a Slovenian company in which he holds half. According to the commercial register extract, the chairman of the board is the lawyer Thomas Stern. Floin became known in 2023 for selling its own token, listed on floin.com today under the ticker FLTK: a private sale ran until mid-July 2023, and on 20 July 2023 Floin announced the start of the public sale. In January 2024, the security firm Halborn published a case study on Floin: auditing the smart contract and the platform, it found 34 vulnerabilities, all of which Floin fixed according to Halborn.

How big Floin is can be seen in the 2024 annual accounts that the company publishes itself: revenue of CHF 3.28 million (2023: CHF 3.63 million), a net profit of CHF 201,193 and share capital of CHF 250,000. The accounts were reviewed by the auditor Grant Thornton in Schaan.

At the same time, Floin is raising equity from its community. On its offering page, the company sells preferred shares of Floin AG as tokens called FLEQ, based on a prospectus approved by the FMA on 30 June 2026. The community round runs at CHF 1.44 per share, the minimum subscription is CHF 5,000, followed by a twelve-month lock-up. Floin cites a valuation of about €45 million; on Saturday the page showed 10,510 of 1,000,000 shares in this round as sold. In total, the offering covers up to CHF 7 million. MiCA custody protection does not apply to buyers of these shares: as shareholders, they carry the business risk.

In the MiCA register of the EU securities watchdog ESMA, Floin AG has been listed since 10 June 2026 with an authorisation from the FMA Liechtenstein for five services: custody of crypto assets for clients, exchange for funds, exchange for other crypto assets, placing and transfer. Through the EU passport, the licence applies across the European Economic Area, including Germany and Austria. Every customer email also carries the number 329177 as a registered virtual asset service provider (VASP) with the FMA.

What Floin told its customers in 2026 adds up to a dense timeline, compiled from the customer emails and the ESMA register:

Floin and deposit insurance: what MiCA provides in an emergency

There is no deposit insurance for crypto assets as there is for a bank account, not even at a MiCA-licensed provider. The statutory deposit guarantee under EU Directive 2014/49/EU protects bank deposits up to €100,000 per customer and bank. Coins on a crypto platform are not bank deposits.

What the MiCA Regulation (EU) 2023/1114 requires instead:

• Segregated custody: crypto assets held in custody legally do not belong to the provider's estate, and the provider's creditors have no recourse to them in insolvency (Article 75(7)).
• Liability: if a provider loses crypto assets or the means of access to them through an incident attributable to it, it is liable to the client, capped at the market value at the time of the loss (Article 75(8)).
• Cash balances: client funds must be placed with a bank or a central bank by the end of the next business day, separate from the provider's own money (Article 70).
• Reporting duty: since 1 February 2025, the EU Digital Operational Resilience Act (DORA) also applies in Liechtenstein. Floin must report a major ICT incident to the FMA, with the initial notification usually within 24 hours of becoming aware of it (Article 19). Whether Floin has reported the attack is not known.

In practice, whether Floin customers get money back in case of a loss depends on what was taken and whether Floin covers it from its own funds or insurance. Floin's notice on Saturday does not mention a protection fund like Binance's SAFU.

Crypto hacks in quick succession: how attackers are getting through

Floin is the second incident at a centralised platform within 48 hours. On the evening of 29 October, about $6.3 billion left Binance according to the exchange, more than in any crypto hack before. We collect all major cases on our crypto hacks page.

The pattern of the big cases is the same: attackers do not break the cryptography, they break people and devices. At Binance, according to the exchange, the entry point was the compromised laptop of a DevOps engineer, through which the attackers reached a service container that releases withdrawals; who is believed to be behind it is covered in Binance hack: everything we know. The FBI attributed the Bybit hack of February 2025, about $1.5 billion, to North Korea. At Ledger, in December 2023, a phishing attack on a former employee was enough to publish a tampered version of a software library; customers lost about $600,000, BleepingComputer reported.

How the attackers got into Floin is unknown. One detail sets the case apart all the same: Binance named a loss figure on the day of the attack and shortly afterwards pledged to cover all customer losses. So far, Floin only points to its website.

Self-custody, exchange or broker: where your money is safer after the Floin hack

There is no place without risk, only different risks. On an exchange you carry the provider's risk, in your own wallet your own, and with a broker you usually buy a financial product on the price instead of coins.

Self-custody makes you independent of Floin, Binance and every other platform, but solely responsible. Users of the software wallet Atomic Wallet lost more than $100 million in June 2023 according to Elliptic, which links the theft to North Korea's Lazarus Group. In January 2025, kidnappers in France abducted Ledger co-founder David Balland to extort a crypto ransom, as The Local reported. And how fast a single mistake can cost everything was shown on 30 October by an influencer who posted her private key instead of the contract address: Mika's memecoin drained in 81 seconds.

If you want to hold your own keys, you need a hardware wallet and a properly secured recovery phrase. We compare the devices in our hardware wallet comparison.

Regulated broker instead of crypto exchange: what XTB offers

An alternative that suggests itself after a week like this one: a brokerage account with shares, ETFs and gold, and crypto only as a small addition. One example is XTB. In the UK, XTB Limited is authorised and regulated by the Financial Conduct Authority; according to XTB, client funds are protected by the Financial Services Compensation Scheme up to £85,000 per person if the broker becomes insolvent. XTB offers shares and ETFs, while gold and cryptocurrencies are traded as CFDs.

For crypto this means: with a CFD you do not own any bitcoin, you cannot move it to a wallet or hold it yourself. You bet on the price. In return, there is no deposit address that can be hacked. XTB's mandatory warning, as of 31 October 2026: CFDs are complex instruments and come with a high risk of losing money rapidly due to leverage. 74% of retail investor accounts lose money when trading CFDs with this provider. You should consider whether you understand how CFDs work and whether you can afford to take the high risk of losing your money.

Open an account with XTB (partner link). How the broker performs in practice is covered in our XTB review, the alternatives in our crypto broker comparison.

What Floin customers should do now

1. Send nothing to Floin addresses. Check recurring buys, standing orders and saved withdrawal addresses at other exchanges and wallets, and delete Floin addresses there.
2. Beware of phishing. Hacks are followed by fake emails with supposed refund forms or support contacts. Floin says it will only inform customers via its website and is not answering individual enquiries. Never enter your recovery phrase or password anywhere.
3. Secure your records. Save the statements, transaction receipts and screenshots you already have. You will need them for possible claims and for your tax return.
4. Change passwords if you use your Floin password elsewhere, and check two-factor authentication there.
5. Know the supervisor. Floin is supervised by the Financial Market Authority Liechtenstein, where you can file a complaint.

Anyone who has used a self-custody wallet in the Floin app since March holds the keys themselves, according to Floin's own description. The notice does not say whether these wallets are affected; the deposit warning applies to all Floin wallet addresses without distinction.

Our view: a MiCA licence is no shield against hacks

A MiCA licence proves that a provider must follow rules on custody, capital and liability and is supervised. It does not prove that it cannot be attacked. That applies to Floin as much as to any large exchange.

The real test for Floin starts now: how quickly the company says what happened, whether customer assets are affected and when withdrawals will resume. The longer these three answers are missing, the stronger the case for the split we recommended after the Binance hack: what you trade sits on a regulated exchange, what you hold long term on your own hardware wallet, and if you only want exposure to the price, a brokerage account can do that too. CryptoTicker asked Floin for a statement on the current situation on 31 October; we will add it here as soon as it arrives, along with any new information on the status page.

Disclosure: CryptoTicker's publisher holds a customer account with Floin that is not actively used; Floin's notice of 31 October arrived through it.