For generations, most Americans have deposited their money in banks knowing that if things somehow went wrong, their funds would be covered by the full force of the government treasury. Up to $250,000 in losses are covered through the Federal Deposit Insurance Corporation (FDIC), born from the ashes of the Great Depression. Cryptocurrency investors are likely craving an FDIC equivalent after Binance, the world’s largest cryptocurrency exchange, was hacked on October 29, with an estimated impact of $6.3 billion, raising questions about the recovery of stolen funds and the broader consequences for cryptocurrency markets. Around $3 billion of stolen assets have been frozen so far, according to a security update from Binance. In a security update on Saturday, the exchange said it had replenished 90% of the stolen assets and pledged to cover the remaining 10%. Blockchain researchers at TRM Labs and Chainalysis have linked the attack to North Korea, but neither the US government nor Binance have publicly confirmed any source of the hack. Understanding how cryptocurrencies are protected online and what mechanisms exist to serve an insurance-like function is increasingly important as more Americans invest in cryptocurrencies. About one in five American adults say they have invested in, traded or used cryptocurrencies, according to the Pew Research Center, a figure that is even higher among high-income households (27%). The Securities and Exchange Commission’s 2024 and 2025 research puts that figure closer to 15%, and estimated that roughly 9% of the investing public owned cryptocurrencies at the time of its survey. Their survey work indicates that cryptocurrency ownership is more common among younger people, men, and those with higher risk tolerance, but who also possess greater financial literacy. While Binance was keeping its promise after the hack to cover all losses with its SAFU (Secure Asset Fund for Users) and funds from other companies (and there is no evidence of a wallet private key leak in this incident), Nikolas Behar, a cybersecurity expert and professor at the University of San Diego, said that crypto investors should understand when using crypto platforms that a promise is just a promise “until there is an actual payment.” We are left to navigate a patchwork of options that vary from exchange to exchange and are often very ambiguous. Many exchanges say that customers will be refunded if something goes wrong. Josephine Wolff, a professor of cybersecurity policy at the Fletcher School at Tufts University, said “there really is no legal protection for crypto assets equivalent to FDIC insurance.” Customers could try to sue a hacked exchange, he said, for example, alleging that it was negligent, or they could recover some funds if the exchange goes bankrupt, as happened with FTX. But “there is no guarantee of compensation,” he said. Michael Tanguma, co-founder and CEO of Onramp Bitcoin, a bitcoin financial services and custody company, said that when an exchange is hacked, customers typically get their money back, “but only because the exchange decides to pay and has the money to do so.” “Nothing in the law requires it,” Tanguma said. “Some stolen funds may be frozen. Tether and Circle, the companies behind the two largest dollar-backed tokens, froze billions of dollars of stolen money this week, and authorities occasionally recover assets years later,” Tanguma said. But he added that Bitcoin has no company behind it that can freeze it, so once it leaves their control, it almost always disappears. Customers who lose funds individually are in a very different situation than those caught in a currency attack. “When your own account is compromised, through a stolen password, a phishing link, or a hijacked phone number, the picture is much worse,” Tanguma said, noting that exchanges typically treat such losses as a customer issue, and because crypto transactions are final once confirmed, there is no bank to call and no charges to dispute. Storing your own digital currency Tanguma said keeping coins offline can protect against the type of attack that hit Binance, although there are other risks associated with this approach to digital security. “The stolen funds come from wallets that the exchange keeps connected to the internet to process daily withdrawals, not from its offline reserves,” Tanguma said. But he added that the details of this hack point to a bigger problem. “Binance says no keys were leaked. The attackers manipulated the system that approves withdrawals, the same approach used in the $1.5 billion theft from Bybit last year, which targeted a transfer out of cold storage,” Tanguma said, noting that every escrow setup has a weak point, and in most of them it’s just one. “In an exchange, that point is the company: its employees, its approval systems, its finances and its willingness to pay you,” Tanguma said. When you have your own coins, he said, that point is you: a lost device, a backup found by the wrong person, a tampered device purchased from an unofficial seller, a transaction approved under pressure or a family unable to recover funds after a death. “Taking savings out of a stock market trades one type of risk for another. It doesn’t eliminate risk,” Tanguma said. The chances of recovering money after a cryptocurrency hack Sarah Downey, executive vice president and global leader of blockchain and digital asset advisory at Lockton, an insurance brokerage, said other factors also come into play in determining whether you can recover your crypto, including how quickly the theft is discovered, where the funds were moved, whether the exchange or wallet provider has insurance to cover the event, and whether it has enough reserves to pay customers. “Some firms have established FDIC-like insurance or other backups, but the payment of these funds depends largely on the facts of each case. Even without insurance, many exchanges attempt to pay clients from their own reserves to protect both their clients and their own reputations,” Downey said. Refunds from cryptocurrency exchanges have followed other security compromises, such as after dishonest foreign support agents were bribed to help scam Coinbase customers in May 2025. Bitget, another major exchange, had to tap an internal fund to refund customers after a $388 million hack in September. Gracy Chen, CEO of Bitget, said its User Protection Fund, which held more than $464 million, covered the loss. “The Protection Fund was created for times like this and absorbed the financial impact of the incident,” Chen said in a post on X at the time. By comparison, Binance’s emergency reserve, the Secure Asset Fund for Users, or SAFU, is estimated at approximately $1 billion to $1.2 billion, and excluding funds that were frozen, this represented around a third of the loss. The company said it had set aside more than $6.34 billion in company funds and already had more than $5 billion in corresponding token assets. Downey said the steps to take if your cryptocurrency is hacked depends on whether investors have their own custody or use a third party, such as a regulated exchange. “If they use a third party, they should verify that most funds are stored offline or secured with multi-party calculations. An investor’s own funds should also be stored separately from the exchange’s own funds,” Downey said, adding that clients should also understand how the custodian authorizes transactions and governs storage. Ryan Reck, founder and director of Reck Advisory, an independent cybersecurity advisory firm, points out the lack of oversight of cryptocurrencies. “Cryptocurrencies have no undo button. Once a transfer is confirmed, there is no chargeback and no one to reverse it,” Reck said. In some cases, stolen funds may be frozen by a receiving exchange or stablecoin issuer to a specific blockchain address, but tracking the money and recovering it are two different things. Among the common reasons investors cite for investing in cryptocurrencies are diversification from traditional assets, as well as using cryptocurrencies as a digital version of gold, investing in the theme of decentralization of finance, and betting that as more institutions adopt digital currencies, that will serve as a tailwind. And, of course, there is speculation too. Today, there are ways to invest in cryptocurrencies that do not require holding the underlying currency in a wallet, such as exchange-traded funds, including the iShares Bitcoin Trust (IBIT), which has more than $62 billion in assets, or the Fidelity Wise Origin Bitcoin Fund (FBTC), which has more than $15 billion in assets. There are also diversified crypto index ETFs that hold a basket of major digital currencies, including the Bitwise 10 Crypto Index Fund (BITW) and the Grayscale CoinDesk Crypto 5 ETF (GLDC). For investors who want to own cryptocurrencies directly, Reck says before trusting any platform, ask four questions: What is covered? What is excluded? How much coverage is there for all customers combined? Do I have an enforceable right to receive a refund? “‘Insured’ is where the conversation starts, not as proof that your money is protected,” Reck said. —CNBC’s Jenny Lee contributed reporting.
