Short answer: when a crypto exchange gets hacked it freezes withdrawals, tries to trace and freeze the stolen funds and then decides who absorbs the loss. If the exchange has enough money of its own your balance is made whole. If it does not, customers can wait years and get back only part of what they held.
On October 29, 2026 Binance lost about $6.3 billion in the largest crypto theft on record. Here is what happened, what it means for you and what to do this week.
What happened in the Binance hack?
Late Thursday afternoon Eastern time funds began leaving Binance hot wallets. TRM Labs counted about $6.36 billion moved across ten blockchains, most of it in roughly 20 minutes. That is about four times the $1.5 billion Bybit theft of February 2025.
- How they got in. Binance said its initial investigation pointed to a compromised DevOps engineer's laptop that let the attacker reach a service container and submit unauthorized withdrawals. It found no evidence that a wallet private key leaked.
- Who did it. TRM Labs and Chainalysis both attribute the theft with high confidence to TraderTraitor, a North Korean state hacking unit the FBI also blamed for the Bybit theft.
- How much Bitcoin. CoinDesk reported 18,270 BTC among the stolen assets. That is more Bitcoin than Tesla holds.
- What was frozen. Industry partners froze about $3 billion on-chain. Most of that was stablecoins, which their issuers can block. Bitcoin cannot be frozen that way.
- Who pays. Binance said it set aside more than $6.34 billion from its SAFU emergency fund and company money to cover every loss and that user funds are safe.
Bitcoin slipped below $77,000 for the first time in more than a month and US spot Bitcoin ETFs saw $643 million in net outflows on Friday per SoSoValue data. For how that works see crypto ETF outflows explained.
What happens to your money when an exchange is hacked
Exchange hacks follow the same four stages.
- Lockdown. The exchange pauses withdrawals and revokes access. Binance suspended withdrawals and kept deposits open.
- The freeze race. Analytics firms and stablecoin issuers try to block stolen funds before the hacker swaps them. Chainalysis watched the attacker convert $325 million in stablecoins in about 20 minutes to dodge freezes.
- The money question. Can the exchange cover the hole from reserves, insurance or outside funding? This decides whether customers lose anything.
- Reopening. Withdrawals come back in phases after security testing. Binance said it would restart withdrawals in phases once checks pass and publish an updated proof of reserves with results targeted for Monday, November 2.
Your balance keeps showing the same number. That number is a claim on the exchange, only as good as its ability to pay.
Three hacks, three very different outcomes
The strength of the company matters more than the size of the hack.
| Hack | Stolen | What customers experienced |
|---|---|---|
| Mt. Gox (2014) | About 850,000 BTC reported missing | Exchange collapsed into bankruptcy. Repayments are still not finished. The trustee just moved the deadline from October 31, 2026 to October 31, 2027 |
| Bybit (February 2025) | About $1.5 billion | Exchange stayed open and said it replaced the stolen funds within days |
| Binance (October 2026) | About $6.3 billion | Withdrawals paused. Binance pledged more than $6.34 billion to cover all losses |
The Mt. Gox trustee notice dated October 16, 2026 says many creditors still have not received their repayments. If an exchange cannot cover a hack the process looks like our guide on what happens to your crypto if an exchange goes bankrupt.
Is crypto on an exchange insured?
Not the way your bank account is. The Securities Investor Protection Corporation states plainly that SIPC does not protect any digital or crypto asset that does not qualify as a registered security. FDIC insurance covers bank deposits, not crypto.
Private insurance and emergency funds like Binance's SAFU are company promises with limits. In a filing with the SEC, Coinbase notes that total customer assets on its platform are substantially more than its corporate assets and available insurance.
A regulated US custodian with strong reserves is a very different bet from a small offshore platform. Our guide to what a crypto trust bank is explains the newest federally chartered custodians.
Hot wallets vs cold storage: where the risk sits
| Hot wallet | Cold storage | |
|---|---|---|
| Connected to the internet | Yes | No |
| Used for | Daily withdrawals | Most customer holdings |
| Speed | Instant | Slower, needs offline steps |
| Hack risk | Higher | Much lower |
Coinbase says in its latest annual report that it generally seeks to hold no more than 2% of assets under custody in hot wallets at any time. The Binance attack hit hot wallets. After the news Reuters reported that Coinbase adjusted its offline key systems out of an abundance of caution.
Copy that at home: a small trading balance online and long-term holdings in cold storage you control.
What to do if your exchange gets hacked: a checklist
If you are new and want a simple setup from day one, the free CCF Quick Start Guide walks you through safe first steps.
- Do not panic sell. Selling into a hack-driven drop can lock in a loss.
- Use official channels only. Read updates on the exchange's own site or verified accounts. Ignore links in emails, texts and DMs.
- Screenshot your balances. Save balances, open orders and recent transactions with dates.
- Lock down your login. Change your password, use an authenticator app or security key and never share your seed phrase.
- Watch for recovery scams. Anyone promising to get your crypto back for an upfront fee is a scammer. Report fraud to the FBI's IC3.
- Move long-term coins when it reopens. Send coins you do not trade to a hardware wallet. Copy the address fresh and send a small test first. Our guide on sending crypto to the wrong address shows why.
- Buy hardware wallets direct. On October 30 Trezor warned that a device sold by a third-party reseller may have carried a suspected hidden implant that could capture recovery phrases.
- Spread your risk. Do not keep everything on one platform. See crypto risk management basics.
For the full setup on wallets, seed phrases and two-factor login read how to keep crypto safe.
How to judge whether an exchange is safe
- Proof of reserves. Many exchanges publish proof they hold customer assets one-for-one. It is a snapshot of one day, not every day.
- Regulation. US-regulated platforms face licensing and reporting rules. On October 13, 2026 the CFTC proposed a voluntary federal registration path for some crypto exchanges.
- Track record. Check how it handled past incidents and whether it paid customers in full.
Chainalysis tracked over $3.4 billion stolen in 2025 with Bybit alone accounting for $1.5 billion. The biggest thefts now come from state-backed groups targeting exchanges.
Frequently asked questions
What happens if a crypto exchange gets hacked?
The exchange freezes withdrawals, works to trace and freeze stolen funds and decides how to cover the loss. If it has enough reserves customers are made whole. If not they may become creditors in a bankruptcy.
Is my crypto safe on Binance after the hack?
Binance says user funds are safe and it set aside more than $6.34 billion to cover all losses. It planned to restore withdrawals in phases and publish updated proof of reserves results targeted for November 2. Check its official announcements for the latest status.
Will I get my money back if my exchange is hacked?
Only if the exchange or its insurance can cover the loss. Binance and Bybit covered their hacks. Mt. Gox customers are still waiting more than a decade later.
Is crypto on an exchange FDIC or SIPC insured?
No. FDIC covers bank deposits and SIPC does not protect crypto that is not a registered security. Some exchanges have private insurance or emergency funds with limits.
Why do exchanges stop withdrawals after a hack?
To stop more funds leaving while they find the breach and rebuild systems. Withdrawals usually return in phases.
Should I move my crypto off an exchange?
Many investors keep only their trading balance on an exchange and hold long-term coins in a hardware wallet. Learn to back up your seed phrase first.
The bottom line
When an exchange gets hacked your outcome depends on who stands behind it. Binance pledged to cover all $6.3 billion. Mt. Gox customers are still waiting. Keep a small trading balance on a strong regulated platform, move long-term holdings to cold storage you control and ignore anyone who contacts you offering help. If you want structured guidance on investing and trading digital assets the simple way with AI on your side, explore our CCF programs.
This article is general education, not financial, tax or legal advice. Details of the Binance incident were still developing as of October 31, 2026, so confirm the latest with official sources. Trading and investing in digital assets involves risk including loss of your capital.
Free Quick Start Guide
Want more like this?
Get the free CCF Quick Start Guide. Security and first-buy checklists, chart basics, the 1% risk rule and paper trading in one 42-page PDF.
Education only, not financial advice. We never share your details.
Prefer to talk? Book a call
Written by
CCF · Co-founder
Teaches trading and investing built on risk management, with AI to sharpen each decision. He lives by the power of 1%: small consistent daily effort makes you the person you want to be.
CCF · Co-founder
Has been in crypto since 2017 and helps people learn investing and trading through structured practical education built on risk management so they can decide with confidence and grow steadily.
Educational content only. This article is general education about digital assets, trading and investing. It is not individualized financial, investment, legal or tax advice, and it is not a recommendation to buy or sell any asset. Crypto markets are volatile and involve risk, including loss of principal; leveraged products can lose more than the amount committed. CCF does not guarantee any outcome or return. Do your own research and consider speaking with a licensed professional about your situation.
