An unprecedented hack at Binance, the world’s largest cryptocurrency exchange, is a reminder of the risks investors take when they trust a company to hold their digital tokens. Binance said on Friday that the security breach affected around $6.3 billion in customer assets, making it the largest cryptocurrency hack on record. About $3 billion of affected assets have been frozen on blockchain networks, and the exchange says it has begun recovering some of them. Binance’s initial investigation suggests that hackers gained access to the company’s withdrawal systems and were able to make unauthorized transfers from the exchange’s crypto wallets, according to the company. The company says it has found no evidence that the private keys controlling those wallets were leaked and is still investigating the full scope of the breach. The company says it will cover customer losses. Binance maintains an emergency fund of approximately $1 billion known as SAFU, which was created to protect customers in the event of a security breach. The company initially said SAFU and company funds would cover the losses, and has since said it has set aside more than $6.3 billion of its own funds. For cryptocurrency investors, the Binance breach highlights one of the risks of holding assets on an exchange. While exchanges make it easy to buy, sell, and store cryptocurrencies, what happens after a hack can vary widely, including whether customers get their money back. What happens to your cryptocurrencies when an exchange is hacked? Hacks of cryptocurrency exchanges are not uncommon. Hackers stole approximately $1.5 billion from Dubai-based Bybit exchange in 2025, while Seychelles-registered Bitget lost more than $387 million in an attack in September 2026. But an attack doesn’t necessarily mean customers will lose their money permanently. Stolen assets can sometimes be recovered or frozen, preventing hackers from moving or cashing them, and exchanges may also have insurance, dedicated emergency funds, or other company resources available to cover losses. In the case of Binance, approximately half of the affected assets have already been frozen, preventing some of the stolen cryptocurrencies from being moved. Its roughly $1 billion SAFU emergency reserve provides another backup, if needed. Customers do not always quickly recover stolen digital assets. New Zealand exchange Cryptopia was forced to liquidate months after a 2019 hack in which around NZ$30 million in cryptocurrency was stolen. The liquidation process dragged on for years, with the first distributions finally beginning in 2024. “When you leave cryptocurrencies on an exchange, you are trusting the controls of that company and its balance sheet,” says Martin Mulyadi, YHB Accounting Chair and professor of accounting at Shenandoah University. “A commitment to making customers whole is only as strong as the resources behind it.” What to look for when choosing a cryptocurrency exchange When considering where to trade and hold cryptocurrency, start by researching the exchange itself. The Securities and Exchange Commission recommends looking for customer complaints and checking how the stock market is regulated. US customers can also check if an exchange is registered with the Treasury Department’s Financial Crimes Enforcement Network, or FinCEN, using its online database. Registration can help confirm that you are an identifiable company operating within the US regulatory system, although FinCEN cautions that registration is not an endorsement of the company. Crypto experts also recommend reading an exchange’s user agreement or terms of service. Some exchanges may have separate escrow agreements or risk disclosures that are also worth checking, says Mulyadi. Look for language that explains who owns your crypto and what the exchange can do with it. Phrases like “you retain title” or the assets “are held for your benefit” are good signs, Mulyadi says. Check if client assets are kept separate from those of the exchange, which can offer additional protection if the company goes bankrupt. And find out if the exchange can lend or use your crypto, which may expose your assets to additional risks. In the user agreement, look at the exchange’s limitation of liability section, Mulyadi says, and look at what insurance coverage the exchange offers and what it actually covers. “If a refund after a hack is at the discretion of the exchange, it is a gesture of goodwill, not a promise,” says Mulyadi. Even strong language in the terms is no guarantee that your assets will be safe. FTX, the popular cryptocurrency exchange that collapsed in 2022, misappropriated billions of dollars in client funds even though its terms said those assets belonged to clients, Mulyadi says. Is it safer to keep your cryptocurrencies on an exchange or keep them yourself? If you don’t want to hold your cryptocurrencies through an exchange, there is another option known as “self-custody.” Wallets usually come with a recovery phrase, essentially a master password that can be used to restore access to the wallet if you lose it. That gives you control of your crypto without relying on an exchange, but also makes you responsible for keeping that information secure. And for anyone who has ever lost or forgotten a password, the risks of self-custody are real. With self-custody, “there is no support if you lose your recovery phrase,” says Mulyadi. For many investors, Mulyadi says a middle ground is to hold only what they actively trade on an exchange and hold assets themselves for the long term, as long as they understand how to store and retrieve them safely. “Coins in an exchange are a promise from a company; coins in your own wallet are a responsibility you can’t pass on,” says Mulyadi. Take control of your money with CNBC Select CNBC Select is editorially independent and may earn commission from affiliate partners through links.
