For generations, most Americans deposited their money in banks knowing that if things went wrong, their funds would be covered by the full resources of the public treasury. Up to $250,000 in losses are covered by the Federal Deposit Insurance Corporation (FDIC), born from the ashes of the Great Depression.
Crypto investors likely want an equivalent of the FDIC after the hack of Binance, the world’s largest crypto exchange, on Oct. 29 with an estimated $6.3 billion impact, raising questions about the recovery of stolen funds and the broader fallout across crypto markets. Around $3 billion in stolen assets have been frozen so far, according to a Binance security update.
In a security update released on Saturday, the exchange said it had replenished 90% of the stolen assets and was committed to covering the remaining 10%. Blockchain investigators from TRM Labs and Chainalysis have linked the attack to North Korea, but neither the US government nor Binance have publicly confirmed the source of the hack.
Understanding how cryptocurrencies are protected online and what mechanisms exist to play an insurance-like role is increasingly important as more Americans invest in cryptocurrencies.
According to the Pew Research Center, about one in five American adults say they have invested in, traded or used cryptocurrencies, an even higher figure among higher-income households (27%). Securities and Exchange Commission research from 2024 and 2025 puts that figure closer to 15% and estimates that about 9% of public investors owned cryptocurrencies at the time of their survey. His survey work indicates that cryptocurrency ownership is more common among younger people, men, and those with a higher risk tolerance but also possessing higher financial knowledge.
While Binance stood by its pledge following the hack to cover any losses with its SAFU (Secure Asset Fund for Users) and other companies’ funds — and there is no evidence of a wallet private key leak in this incident — Nikolas Behar, a cybersecurity expert and professor at the University of San Diego, said crypto investors need to understand when using crypto platforms that a pledge is just a pledge “until that there is a real payment.
If something happens to your crypto, most consumers must navigate a patchwork of options that vary from exchange to exchange and are often very ambiguous. Many exchanges claim that customers will be refunded if there is a problem.
Josephine Wolff, a professor of cybersecurity policy at the Fletcher School at Tufts University, said that “there really is no legal protection for crypto assets equivalent to FDIC insurance.”
Customers could attempt to sue a hacked exchange, she said, such as claiming it was negligent, or recover funds if the exchange declares bankruptcy, as happened with FTX. But “there is no guarantee of compensation,” she said.
Michael Tanguma, co-founder and CEO of Onramp Bitcoin, a bitcoin financial services and custody company, said that when an exchange is hacked, customers are usually refunded, “but only because the exchange decides to pay and has the money to do so.”
“Nothing in the law requires it,” Tanguma said.
“Some stolen funds may be frozen. Tether and Circle, the companies behind the two largest dollar-backed tokens, froze billions of dollars of stolen money this week, and law enforcement sometimes recovers assets years later,” Tanguma said. But he added that Bitcoin has no company behind it that can freeze it, so once it leaves your control, it almost always disappears.
Customers who lose funds individually are in a very different situation than those who fall victim to an exchange attack.
“When your own account is compromised, through a stolen password, phishing link or hacked phone number, the outlook is much worse,” Tanguma said, noting that exchanges typically treat such losses as the customer’s problem and that because crypto transactions are final once confirmed, there is no bank to call or fees to dispute.
Store your own digital currency
Tanguma said keeping coins offline can protect against the type of attack that hit Binance, although there are other risks associated with this digital security approach.
“The stolen funds came from wallets that the exchange maintains connected to the internet to process daily withdrawals, not from its offline reserves,” Tanguma said. But he said the details of the hack reveal a larger problem.
“Binance claims no keys were leaked. The attackers manipulated the system that approves withdrawals, the same approach used in last year’s $1.5 billion Bybit heist, which targeted a transfer out of a cold storage facility,” Tanguma said, noting that every custody setup has a weak point, and in most of them, it’s just one.
“In an exchange, that point is the company: its people, its approval systems, its finances and its willingness to reimburse you,” Tanguma said. When you hold your own coins, he said, what matters is you: a lost device, a backup found by the wrong person, a tampered device purchased from an unofficial seller, a transaction approved under pressure, or a family unable to access funds after a death.
“Withdrawing savings from an exchange exchanges one type of risk for another. It does not remove risk,” Tanguma said.
Chances of getting money back after a crypto hack
Sarah Downey, executive vice president and global head of blockchain and digital assets consulting at Lockton, an insurance brokerage, said other factors also come into play in determining whether you can recover your crypto, including how quickly the theft is discovered, where the funds were moved, whether the exchange or wallet provider has insurance that covers the event, and whether it holds enough reserves to reimburse customers.
“Some companies have FDIC-style insurance or other safeguards in place, but whether these payments are made depends heavily on the facts of each case. Even without insurance, many exchanges attempt to reimburse customers from their own reserves to protect both their customers and their own reputations,” Downey said.
Refunds from crypto exchanges have followed other security compromises, such as after dishonest foreign support agents were bribed to help scam Coinbase customers in May 2025. Bitget, another major exchange, had to dip into an internal fund to reimburse customers after a $388 million hack in September. Gracy Chen, CEO of Bitget, said its user protection fund, which held more than $464 million, covered the loss. “The Protection Fund was created for times like this and absorbed the financial impact of the incident,” Chen said in a post on X at the time.
For comparison, Binance’s emergency reserve, the Secure Asset Fund for Users, or SAFU, is estimated at between $1 billion and $1.2 billion, and if we exclude frozen funds, that represents about a third of the loss. The company said it has set aside more than $6.34 billion in corporate funds and already holds more than $5 billion in matching token assets.
Downey said what steps to take if your crypto is hacked depends on whether investors self-custody or use a third party, such as a regulated exchange.
“If they use a third party, they should verify that most of the funds are stored offline or protected by a multi-party calculation. An investor’s own funds should also be stored separately from the exchange’s own funds,” Downey said, adding that clients should also understand how the custodian authorizes transactions and governs storage.
Ryan Reck, founder and principal of Reck Advisory, an independent cybersecurity consulting firm, highlights the lack of crypto oversight.
“Crypto doesn’t have a cancel button. Once a transfer is confirmed, there are no chargebacks and no one can undo it,” Reck said. In some cases, stolen funds may be frozen by an exchange that receives them, or by a stablecoin issuer at a specific blockchain address, but tracing the money and getting it back are two different things.
Common reasons cited by investors for investing in crypto include diversification from traditional assets, as well as using crypto as a digital version of gold, investing in the theme of decentralization of finance, and betting that as more institutions adopt digital currencies, it will serve as a tailwind. And of course there is also speculation. Today, there are ways to invest in crypto that don’t require holding the underlying currency in a wallet, such as exchange-traded funds including the iShares Bitcoin Trust (IBIT), which has over $62 billion in assets, or the Fidelity Wise Origin Bitcoin Fund (FBTC), which has over $15 billion in assets. There are also diversified crypto index ETFs holding a basket of major digital currencies, including the Bitwise 10 Crypto Index Fund (BITW) and the Grayscale CoinDesk Crypto 5 ETF (GLDC).
For investors who want to hold cryptocurrencies directly, Reck says that before trusting a platform, ask four questions:
- What is covered?
- What is excluded?
- What is the level of coverage for all customers combined?
- Do I have an enforceable right to reimbursement?
“‘Insured’ is the starting point of the conversation, not proof that your money is protected,” Reck said.
—CNBC’s Jenny Lee contributed reporting
Gn bussni
