.png)
A record-breaking hack at Binance, the world's largest cryptocurrency exchange, is a reminder of the risks investors take when trusting a company to hold their digital tokens.
Binance said Friday that the security breach affected about $6.3 billion in client assets, making it the largest crypto hack on record. Around $3 billion of the affected assets has been frozen on blockchain networks, and the exchange says it has begun recovering some of them.
Binance's initial investigation suggests hackers gained access to the firm's withdrawal systems and were able to make unauthorized transfers from the exchange's crypto wallets, according to the company. The company says it has found no evidence that the private keys controlling those wallets were leaked and is still investigating the full scope of the breach.
The company says it will cover customers' losses. Binance maintains a roughly $1 billion emergency fund known as SAFU, which was created to protect customers in the event of a security breach. The company initially said SAFU and company funds would cover the losses, and has since said it has set aside more than $6.3 billion of its own funds.
For crypto investors, the Binance breach highlights one of the risks of keeping assets on an exchange. While exchanges make it easier to buy, sell and store crypto, what happens after a hack can vary widely, including whether customers get their money back.
What happens to your crypto when an exchange gets hacked
Crypto exchange hacks aren't uncommon. Hackers stole roughly $1.5 billion from Dubai-based exchange Bybit in 2025, while Seychelles-registered Bitget lost more than $387 million in a hack in September 2026.
But a hack doesn't necessarily mean customers will lose their money permanently. Stolen assets can sometimes be recovered or frozen — preventing the hackers from moving or cashing them out — and exchanges may also have insurance, dedicated emergency funds or other company resources available to cover losses.
In Binance's case, roughly half of the affected assets have already been frozen, preventing some of the stolen crypto from being moved. Its roughly $1 billion SAFU emergency reserve provides another backstop, if needed.
Customers don't always recover stolen digital assets quickly. New Zealand exchange Cryptopia was forced into liquidation months after a 2019 hack in which about NZ$30 million in crypto was stolen. The liquidation process stretched on for years, with the first distributions finally beginning in 2024.
"When you leave crypto on an exchange, you are relying on that company's controls and its balance sheet," says Martin Mulyadi, YHB Endowed Chair in Accounting and professor of accounting at Shenandoah University. "A pledge to make customers whole is only as strong as the resources behind it."
What you should look for when choosing a crypto exchange
When considering where to transact in and hold crypto, start by researching the exchange itself. The Securities and Exchange Commission recommends searching for customer complaints and checking how the exchange is regulated.
U.S. customers can also check whether an exchange is registered with the Treasury Department's Financial Crimes Enforcement Network, or FinCEN, using its online database. Registration can help confirm that you're dealing with an identifiable business operating within the U.S. regulatory system, though FinCEN cautions that registration isn't an endorsement of the company.
Crypto experts also recommend reading an exchange's user agreement or terms of service. Some exchanges might have separate custody agreements or risk disclosures that are worth checking, too, Mulyadi says.
Look for language explaining who owns your crypto and what the exchange can do with it. Phrases such as "you retain title" or assets being "held for your benefit" are good signs, Mulyadi says. Check whether customer assets are kept separate from the exchange's own, which can offer extra protection if the company fails. And find out whether the exchange can lend or otherwise use your crypto, which can expose your assets to additional risk.
In the user agreement, check the exchange's limitation-of-liability section, Mulyadi says, and look at what insurance coverage the exchange offers and what it actually covers.
"If a refund after a hack is at the exchange's discretion, it's a goodwill gesture, not a promise," Mulyadi says.
Even strong language in the terms isn't a guarantee that your assets will be safe. FTX, the popular crypto exchange that collapsed in 2022, misappropriated billions of dollars in customer funds even though its terms said those assets belonged to customers, Mulyadi says.
Is it safer to keep your crypto on an exchange or hold it yourself?
If you don't want to hold your crypto through an exchange, there's another option known as "self-custody."
With self-custody, you use your own crypto wallet and control the private keys used to authorize transactions on the blockchain. Wallets typically come with a recovery phrase — essentially a master password that can be used to restore access to the wallet if you lose it.
That gives you control of your crypto without relying on an exchange, but it also makes you responsible for keeping that information safe.
And for anyone who's ever lost or forgotten a password, the risks of self-custody are real. With self-custody, there is "no help desk if you lose your recovery phrase," Mulyadi says.
For many investors, Mulyadi says a middle ground is keeping only what they actively trade on an exchange and holding longer-term assets themselves, as long as they understand how to safely store and recover them.
"Coins on an exchange are a promise from a company; coins in your own wallet are a responsibility you can't hand off," Mulyadi says.
English (US) ·