Home › Knowledge Hub › When an exchange is hacked
What happens to your money when a crypto exchange is hacked?
When a crypto exchange is hacked, what happens to your money depends on one thing above all: who was holding it. Crypto on an exchange is held by that company on your behalf, so a theft from the exchange is the company's liability, and whether you are made whole depends on its reserves, its insurance or protection fund, and its choices. This explainer sets out who covers the loss, what a SAFU fund and insurance actually do, how frozen funds work, and why self-custody changes the question entirely.
Most people picture an exchange hack as thieves taking "their" coins. The more accurate picture is that the exchange was holding everyone's coins in its own wallets, and the thieves took from those. That difference, custody, is what decides what happens to you next.
Custody is the whole question
When you hold crypto on an exchange, you do not hold the coins directly. The exchange holds them in wallets it controls, and your balance is an entry in its ledger, a promise to let you withdraw that amount. This is called custodial holding. It is convenient, and it is why a single breach of the exchange can affect millions of customers at once.
The alternative is self-custody: holding crypto in a wallet whose keys only you control, so no company's breach can touch it. The phrase "not your keys, not your coins" is a blunt summary of exactly this. Our guide on cold versus warm wallets covers how self-custody works in practice and its own trade-offs, including that you, not a company, are then responsible for security.
Who covers the loss?
There is no single rule. Whether customers are made whole depends on the exchange, and on a few mechanisms.
- The company's own reserves. A large, solvent exchange may simply absorb the loss to protect customers and its reputation. This is a choice, not an entitlement, and it depends on the exchange having the funds.
- A protection or insurance fund. Some exchanges maintain an emergency fund set aside to cover customer losses from incidents. Binance's Secure Asset Fund for Users, known as SAFU, is the best-known example. These funds help, but their size is finite and their use is at the exchange's discretion.
- Commercial insurance. Some custody providers hold insurance against theft. Coverage, limits, and exclusions vary widely, and insurance typically covers specific scenarios rather than any loss.
- Recovery of the stolen funds. If stolen assets are traced and frozen before they are cashed out, some may eventually be returned. This is uncertain and often partial.
The uncomfortable summary: on an exchange, being made whole after a hack depends on the exchange's solvency and goodwill, not on a guarantee. That is very different from a bank deposit covered by a government scheme.
How frozen funds work
Modern thefts are rarely clean getaways, because the blockchain is public and stablecoins can be frozen. When a large theft happens, blockchain-analytics firms trace the funds in real time, and stablecoin issuers such as Tether and Circle can freeze their tokens in the attacker's wallets, because those issuers retain that control over their own tokens. In the October 2026 Binance incident, nearly 3 billion dollars was reported frozen this way.
Freezing is not the same as returning. Frozen funds are locked where they sit, which stops the thief cashing out and can support later recovery, but getting them back to customers is a separate legal and operational process with no guaranteed outcome. Coins that are not stablecoins, such as ETH or BTC, cannot be frozen by an issuer at all, though they can still be traced and blocked at exchanges where the thief tries to cash out, as our guide on when stolen crypto reaches an exchange explains.
What you can and cannot do
You cannot reverse a blockchain transaction, force an exchange to reimburse you, or personally freeze a thief's wallet. Anyone claiming they can do these things for a fee is running a recovery scam.
You can reduce your exposure and protect yourself:
- Hold less on exchanges than you need to. Keep on an exchange what you actively trade, and consider self-custody for long-term holdings.
- Choose where you hold carefully. Favour exchanges that are transparent about reserves and protection funds. Our guide on how to verify a crypto platform covers what to check.
- Secure your own account with app-based two-factor authentication, a unique password, and withdrawal address controls where offered.
- Expect the scam wave after any public incident and route every action through official channels, never a message.
"Proof of reserves" and what it does not prove
After past failures, many exchanges publish "proof of reserves" showing they hold assets matching customer balances. This is useful but limited: a snapshot of assets does not show liabilities you cannot see, does not prove the assets are unencumbered, and does not protect against a future theft. Treat it as one signal among several, not a guarantee of safety.
What this guide cannot do
It cannot tell you whether a particular exchange will make its customers whole after a specific hack, because that depends on that company's reserves, choices, and the investigation. What it can do is make the deciding factor clear, custody, so you can decide how much to leave in someone else's hands.
This is general information, not legal or financial advice.
Use Chain Pursuit's free tools to understand your options and preserve evidence. Never share your seed phrase, private keys, passwords, or one-time codes with anyone.
Sources
The Hacker News, Binance Suffers Security Breach Affecting $6.3 Billion in Assets, Nearly $3 Billion Frozen, October 2026. https://thehackernews.com/2026/10/binance-suffers-security-breach.html, on how stablecoin issuers froze funds and how analytics firms traced the theft.
CNBC, Binance loses $6.3 billion in crypto heist, what happens to your money when an exchange gets hacked, 30 October 2026. https://www.cnbc.com/make-it/2026/10/30/binance-crypto-hack-customer-funds.html, on custodial risk and what happens to customer funds after an exchange hack.
Federal Trade Commission, consumer guidance on cryptocurrency and custody. https://consumer.ftc.gov/articles/what-know-about-cryptocurrency-and-scams, on the absence of the protections that apply to bank accounts.
Examples and figures are as reported by the sources above as of 2 November 2026. Reviewed quarterly.
Frequently asked questions
If a crypto exchange is hacked, do I lose my money?
Not necessarily. Whether you are made whole depends on the exchange's reserves, any protection fund or insurance, and how much of the stolen crypto is recovered. Unlike a bank deposit under a government scheme, there is no guarantee, so the exchange's solvency and choices decide the outcome.
What is a SAFU fund?
SAFU, the Secure Asset Fund for Users, is Binance's emergency reserve set aside to cover customer losses from incidents. Some other exchanges keep similar protection funds. They help, but their size is finite and their use is at the exchange's discretion, so they are not a guarantee.
Can stolen crypto be frozen or returned?
Stablecoins such as USDT and USDC can be frozen by their issuers, which locks them in the thief's wallet and stops a cash-out. Coins like ETH and BTC cannot be frozen by an issuer, though they can be traced and blocked at exchanges. Freezing is not the same as returning funds to customers, which is a separate and uncertain process.
What does "not your keys, not your coins" mean?
It means that if a company holds the private keys to the wallet your crypto sits in, you are relying on that company, and its breach or failure can affect your funds. In self-custody you hold the keys yourself, so no company's breach can reach your coins, but you are then responsible for securing them.
Is my crypto safer on an exchange or in my own wallet?
Each carries different risk. An exchange can be hacked or become insolvent, but it handles security for you. Self-custody removes company risk but makes you responsible for protecting your keys, and a lost seed phrase or a drainer can be just as final. The right choice depends on how much you hold and how you use it.
Does proof of reserves mean an exchange is safe?
No. Proof of reserves is a snapshot that an exchange holds certain assets. It does not reveal hidden liabilities, prove the assets are unencumbered, or prevent a future theft. Treat it as one useful signal among several, not a guarantee.
Lost funds in an exchange incident?
Eleven questions and an honest view of what documentation and reporting steps apply to your case, with no email required.
Check my case