A record hack at Binance, the world’s largest cryptocurrency exchange, is a reminder of the risks investors take when trusting a company to hold their digital tokens.
Binance said Friday that the security breach affected approximately $6.3 billion in customer assets, making it the largest crypto hack on record. Around $3 billion of the affected assets were frozen on blockchain networks, and the exchange says it has started to recover some of them.
Binance’s initial investigation suggests that hackers gained access to the company’s withdrawal systems and were able to make unauthorized transfers from the exchange’s crypto wallets, according to the company. The company says it has found no evidence that the private keys controlling these wallets were leaked and is still investigating the full extent of the breach.
The company says it will cover its customers’ losses. Binance operates a roughly $1 billion emergency fund, known as SAFU, which was created to protect customers in the event of a security breach. The company initially stated SAFU and company funds would cover the losses and have since said they have set aside more than $6.3 billion of their own funds.
For crypto investors, the Binance breach highlights one of the risks of maintaining assets on an exchange. Although exchanges make it easy to buy, sell and store cryptocurrencies, what happens after a hack can vary widely, including whether customers get their money back.
What happens to your crypto when an exchange is hacked
Crypto exchange hacks are not uncommon. Hackers stole around $1.5 billion from the Dubai-based Bybit exchange in 2025, while Seychelles-registered Bitget lost more than $387 million in a September 2026 hack.
But a hack doesn’t necessarily mean customers will lose their money forever. Stolen assets can sometimes be recovered or frozen – preventing hackers from moving or cashing them out – and exchanges may also have insurance, dedicated emergency funds or other company resources available to cover losses.
In the case of Binance, around half of the affected assets have already been frozen, preventing the movement of some of the stolen cryptocurrencies. Its emergency SAFU reserve of around $1 billion provides another safety net, if needed.
Customers do not always recover stolen digital assets quickly. New Zealand exchange Cryptopia went into liquidation months after a 2019 hack in which around NZ$30 million worth of crypto was stolen. The liquidation process lasted for years and the first distributions finally began in 2024.
“When you leave crypto on an exchange, you’re relying on the controls and balance sheet of that company,” says Martin Mulyadi, YHB chair of accounting and professor of accounting at Shenandoah University. “A commitment to making customers whole is only as strong as the resources behind it.”
What you should look for when choosing a crypto exchange
When thinking about where to transact and hold cryptocurrencies, start by researching the exchange itself. The Securities and Exchange Commission recommends researching customer complaints and checking how the exchange is regulated.
U.S. customers can also check whether an exchange is registered with the Treasury Department’s Financial Crimes Enforcement Network, or FinCEN, using its online database. Registration can help confirm that you are dealing with an identifiable company operating within the U.S. regulatory system, although FinCEN cautions that registration does not constitute an endorsement of the company.
Crypto experts also recommend reading an exchange’s user agreement or terms of service. Some exchanges may have separate custody agreements or risk disclosures that are also worth checking, says Mulyadi.
Look for text explaining who owns your crypto and what the exchange can do with it. Phrases like “you retain title” or assets “held for your benefit” are good signs, Mulyadi says. Check whether client assets are segregated from those of the exchange, which can provide additional protection in the event the company goes bankrupt. And find out if the exchange can lend or use your crypto, which can expose your assets to additional risk.
In the user agreement, look at the exchange’s limitation of liability section, Mulyadi says, and look at what insurance coverage the exchange offers and what it actually covers.
“If reimbursement after a hack is at the discretion of the exchange, it is a gesture of goodwill, not a promise,” explains Mulyadi.
Even strong language in the terms does not guarantee that your assets will be safe. FTX, the popular crypto exchange that collapsed in 2022, misappropriated billions of dollars of customer funds even though its terms indicated those assets belonged to customers, Mulyadi said.
Is it safer to keep your crypto on an exchange or hold it yourself?
If you don’t want to hold your crypto through an exchange, there is another option called “self-custody.”
With self-custody, you use your own crypto wallet and control the private keys used to authorize transactions on the blockchain. Wallets usually come with a recovery phrase – essentially a master password that can be used to restore access to the wallet if you lose it.
This gives you control of your crypto without relying on an exchange, but it also makes you responsible for the security of that information.
And for anyone who has ever lost or forgotten a password, the risks of self-custody are real. With self-custody, there’s “no help desk if you lose your recovery phrase,” Mulyadi says.
For many investors, Mulyadi believes a happy medium is holding only what they actively trade on an exchange and holding assets for the long term themselves, provided they know how to store and retrieve them safely.
“Exchange coins are a promise from a company; coins in your own wallet are a liability that you cannot pass on,” explains Mulyadi.
Gn bussni
