On October 29, 2026, attackers stole about $6.3 billion in crypto from Binance, a theft that industry observers call the biggest crypto hack ever. That leaves every holder with one question: how much risk do you take when you keep coins on an exchange?
This guide is no recap of the hack and gives no verdict on any single exchange. Hack facts are stated as of November 4, 2026.
Key Takeaways
- Crypto exchange risk is counterparty risk: On a custodial exchange, you depend on the company's security and solvency.
- Proof of reserves has limits: It is a snapshot, not an audit.
- Licenses matter: In the EU, clients of unauthorized providers do not get MiCA protections for client assets.
- Deposit insurance does not cover crypto: In the US, the FDIC does not insure crypto assets or the insolvency of crypto exchanges.
- Size balances by purpose: It makes sense to keep only trading funds on an exchange.
- Records protect you: Export your history regularly and track balances across exchanges and wallets.
What the Binance Hack Showed About Exchange Risk
On October 31, the FBI attributed the theft to TraderTraitor, cyber actors sponsored by North Korea. North Korea has denied any involvement.
Binance co-CEO Richard Teng said that Binance will absorb the financial impact of the stolen funds, not its users.
Three lessons apply to any exchange:
- A large platform can be breached.
- Repayment depends on the exchange's own resources and terms.
- Access to your coins can be paused.
How Proof of Reserves Works, and What It Cannot Show
Exchanges publish a proof of reserves to show that they hold the assets behind customer balances.
What is proof of reserves?
A proof of reserves compares an exchange's holdings with its customer balances. Some versions use a Merkle tree, a structure that combines all customer balances into one fingerprint. This lets each customer check that their own balance was counted. The report describes one moment in time and gives no ongoing guarantee.
The SEC and the US audit regulator PCAOB set out the limits in 2023. A proof of reserves is not an audit. It covers only a single point in time, a limit described in the PCAOB advisory on proof of reserves. It also does not tell you the whole story about an exchange's liabilities. The work behind such a report may follow no specific requirements, so the exchange decides what it reports.
The Binance case shows the snapshot limit. According to Binance, it took its reserve snapshot on October 31, after the attack, and finished a cryptographic proof for ten tokens on November 2. On November 4, it took a new snapshot covering 44 tokens, and the full proof was pending at that time. A snapshot taken after an attack shows the backing at that moment and says nothing about the backing before it.
When you read a proof of reserves, use this checklist:
- Check that it covers liabilities as well as assets.
- Check which tokens it includes and which it leaves out.
- Check who prepared it and how recent the snapshot is.
- Check that you can verify your own balance on a public page.
Custody Models: Who Holds Your Keys
In a custodial setup, such as a standard exchange account, the company holds your private keys. How your rights look in a failure depends on the company's terms and the applicable law. In self-custody, you hold the keys yourself in a wallet, so no company has to approve your withdrawal.
Each model shifts the risk instead of removing it. With a custodial account you rely on the company's security and solvency. With self-custody you rely on your own backup, since only the seed phrase can restore a Bitcoin wallet.
Regulation and Licensing: Which Protections Apply
Regulation decides which protections exist at all. In the EU, the transition period under MiCA, the Markets in Crypto-Assets Regulation, ended on July 1, 2026. Since then, a provider that serves EU clients without a MiCA license has to wind down its services in an orderly way.
The European Securities and Markets Authority (ESMA) reminds clients of unauthorized providers that they do not benefit from MiCA safeguards, including protections for client assets. You can check a provider in the official register of authorized providers, which is updated weekly.
A license shows that a provider meets a regulator's requirements, and it does not make a hack or a failure impossible. Outside the EU, the rules differ by country, so check your own regulator's website for the license a provider needs.
See all your balances in one place
CoinTracking supports 400+ exchanges, wallets, and blockchains, so you can follow every balance in one portfolio.
Insurance and User Protection Funds: What They Cover
In the US, bank-style deposit insurance does not cover crypto held on an exchange. The FDIC, the US bank deposit insurer, says its deposit insurance covers deposits at insured banks only. It does not apply to crypto assets and, according to a 2022 fact sheet, gives no protection if a crypto exchange becomes insolvent.
An exchange can set up its own reserve fund instead. Before the attack, Binance's Secure Asset Fund for Users (SAFU) held roughly $1 billion in Bitcoin, according to media reports. Binance said it combined that fund with its Futures insurance fund and its corporate treasury. The loss was much larger than the fund alone.
Before you rely on a fund, read its terms on covered events, payout limits and claim decisions.
Withdrawal Behavior in a Crisis
Access is the first thing a crisis can take away. Binance paused withdrawals on October 29 and began a phased restart on November 1, first for 15 digital currencies. Further assets and networks were to follow in phases, according to the company.
A pause leaves your balance locked, even if the exchange later restores everything. The FDIC noted as far back as July 2022 that some crypto companies had suspended withdrawals or halted operations.
Consider keeping coins for near-term needs somewhere you can reach without the exchange's approval. Use only the exchange's official channels for status updates, and switch on two-factor authentication. Funds you do not need for trading can sit in a wallet of your own.
How Much to Leave on an Exchange
Nobody can name a universal safe amount, because the right balance depends on your own situation. A set of questions works better than a fixed percentage. Ask these questions about each coin you hold:
- How much do you need for trading or spending in the coming weeks?
- How long could you cope if the exchange paused withdrawals?
- How long do you plan to hold the coin?
- How much of your total holdings sits with one provider?
The table sorts coins by purpose as a thinking aid and gives no personal financial advice.
| Purpose | Where it can sit |
|---|---|
| Active trading balance | Exchange account |
| Spending in the coming weeks | Exchange or own wallet |
| Long-term holdings | Own wallet with a backup |
The longer you plan to hold, the stronger the case for self-custody. Spreading balances over several providers adds a second layer, because one failure then freezes only part of your holdings.
What to Do Before Trouble: Export, Record, Track
The best time to secure your records is before an exchange gets into trouble. Export your full transaction history from every exchange as a CSV file on a regular schedule. Keep dated copies of your balances outside the exchange.
CoinTracking supports 400+ exchanges, wallets, and blockchains. You can import your history from each exchange through a read-only API connection or a CSV file. The portfolio tracker then shows your allocation by exchange and wallet.
Your records also matter at tax time. Our article on the Binance hack and US crypto taxes explains whether frozen funds or a reimbursement change your return.
Conclusion
Treat an exchange as a service with counterparty risk, and judge it with the same checks every time. Decide per coin how much to keep there, and keep your own records ready in case something changes.
Keep your records ready
CoinTracking has tracked crypto portfolios for 2.2 million users since 2012. Import your history once, so your records do not depend on a single exchange.
Disclaimer
The information provided in this article is intended for general informational purposes only and should not be construed as financial, tax, or legal advice. The facts about the Binance incident are stated as of November 4, 2026 and may change as the investigation and Binance's reimbursement continue. Regulatory and product details can change without notice, so verify them with the sources linked in this article before you make decisions. The author and publisher are not responsible for any losses or damages incurred as a result of using the information in this article.
