Beginner's Guide View guide → Home：Complete Crypto Learning Path →

Binance new-user bonus · Enjoy 20% fee rebate

Invite codeBINANBT

✅ The invite code is applied automatically when you register — no need to enter it manually

⚠️ Complete identity verification (KYC) after signup to trade & withdraw

⏳ The registration page takes 2–5 seconds to load — please wait, don't tap repeatedly.

Beginner's Guide • 11/8/2026 • Updated 11/8/2026 • Author：CoinVado Research • 28 reads • 15 min

Is It Safe to Keep Crypto on an Exchange in 2026? Lessons From the $6.3B Binance Incident

The crypto in your exchange account is a claim on the platform, not your private key. In the October 2026 Binance incident, users were promised full coverage but withdrawals froze for days; FTX users waited more than three years for distributions. This guide gives you 8 verifiable exchange checks, a withdrawal drill, the warning signs and the legal reality, so you can decide how much to keep where, and what to do if a platform fails.

⚠️ Read this first: if you decide to keep using an exchange, at least get the account entry and referral relationship right. Use the registration link (for example, "Register now") or enter invite code BINANBT to sign up for Binance and qualify for the new-user rewards (20% fee rebate + up to $19,800 welcome package). Note: registering directly inside the app gives you none of these rewards — you must use the registration link or enter the code.

Key takeaways (TL;DR):

Crypto on an exchange is legally a claim on the platform, not your private key. In normal times you see a balance; in a failure you see a creditor claim.

October 2026 was a live stress test. About $6.3 billion was moved out of Binance hot wallets and about $3 billion was frozen. Binance pledged company funds and SAFU to cover users, replenished 90% within two days, and resumed withdrawals in phases — but withdrawals were frozen for days, and users could not move assets when they most wanted to.

"Too big to fail" is not a safety guarantee. Bybit restored 1:1 reserves within 72 hours after a $1.46 billion hack in 2025. FTX creditors were paid in 2026 after a multi-year bankruptcy. Mt. Gox creditors waited about a decade. QuadrigaCX users mostly got nothing.

Judge an exchange on 8 verifiable signals. Proof of reserves, safety fund, licenses, withdrawal history, on-chain reserves, asset segregation, insurance and exit capacity — not ads or founding year.

Rehearse withdrawals before you need them. A small test transfer, the right network, recorded timing and a pre-approved whitelist are worth more than a support ticket during a crisis.

Know what the law gives you. In most jurisdictions you are an unsecured creditor, not an insured depositor; recovery depends on remaining assets and the bankruptcy process, not on the size of the brand.

One-line answer: you hold a claim, not the coins
What actually happened at Binance in October 2026
What the incident proved, and what it did not
Exchange vs self-custody: risk is reallocated, not removed
What users actually recovered when exchanges failed
8 exchange checks you can run without insider access
The withdrawal drill: test the exit before you need it
Seven warning signs: three means act
If it is already happening: a 30-minute action list
What the law does and does not give you
How much to keep where: tiers by purpose and size
If you keep using exchanges, do these 6 things
💰 Binance rebate: invite code BINANBT
FAQ
Further reading

One-line answer: you hold a claim, not the coins

Crypto held on an exchange is not "your coins sitting in a vault." It is a contractual claim on the platform for a quantity of a given asset. You see a balance; the platform sees a liability. You control the login and 2FA; the platform controls the private keys and the on-chain addresses.

That distinction decides three things:

When a platform is hacked, your balance does not automatically vanish, but the platform has to cover the gap from its own resources. If it can, you are fine. If it cannot, your claim becomes a line in a bankruptcy filing.
When your account is frozen, you cannot prove ownership with a private key. You are left with support tickets, appeals, regulators or litigation.
When a platform becomes insolvent, you queue with other creditors. Recovery depends on remaining assets, whether customer assets were segregated and the bankruptcy rules of the relevant jurisdiction.

So the accurate answer to "is it safe to keep crypto on an exchange?" is: its safety depends mainly on the platform's balance sheet, controls and regulatory constraints, not on you. What you control is which platform, how much exposure and whether you can get out.

What actually happened at Binance in October 2026

On October 29–30, 2026, roughly $6.3 billion left Binance hot wallets in unauthorized transfers — the largest crypto theft on record. The timeline matters less for the drama than for what a normal user experiences during a platform-level failure.

Time (UTC)	What happened	What it meant for users
Oct 29, ~20:05	Hot wallets were drained across about 10 chains, with some reports saying the transfers took about 20 minutes	The platform's assets dropped instantly, while account balances still displayed normally
Oct 30, 02:23	Binance announcement: about $6.3 billion affected, about $3 billion frozen on-chain; initial findings pointed to a compromised DevOps engineer's laptop; no evidence of a private-key leak; withdrawals suspended, deposits normal	Your coins were still on the balance sheet but you could not withdraw them — the most concrete form of custody risk
Oct 31	Binance said it had covered about 90% from its own funds, reserved about $6.34 billion, and took a proof-of-reserves snapshot; SAFU was about $1 billion	The platform used its balance sheet to backstop the gap, but "covered" was still the platform's own statement
Nov 1	Withdrawals resumed in phases	Liquidity stress began to ease, though queues and limits could persist
Around Nov 3	Updated zero-knowledge proof-of-reserves results	Reserves could be verified at a point in time, not in real time

As of November 8, 2026, the investigation is still ongoing. The $6.3 billion impact, the $3 billion frozen and the 90% replenishment are preliminary figures. TRM Labs, Chainalysis and Elliptic attributed the attack with high confidence to TraderTraitor, a North Korea-linked group; Binance itself did not publicly name the attacker¹².

The detail worth remembering is the sequence: pause withdrawals, replenish reserves, then resume withdrawals. For users, "the balance is still there" and "I can take it out" are two different things.

What the incident proved, and what it did not

It proved that a top exchange's own capital and emergency arrangements can absorb an unusually large shock. It did not prove that exchanges cannot fail, or that the next gap will be covered.

Proved: large platforms have buffers, but buffers are finite

Binance used three tools: company funds, SAFU and frozen on-chain assets. SAFU is about $1 billion, held with Nest Clearing and Custody Limited, an ADGM-recognized clearing house. But SAFU claims are subject to Binance's "sole discretion," must be filed within 90 days of the loss, and are not described as a contractual or legal entitlement³. Against a $6.3 billion gap, SAFU alone was nowhere near enough; the real backstop was the corporate balance sheet.

That leads to a counterintuitive conclusion: what you are trusting is not the platform's size, but the amount it is both willing and able to deploy at the moment of failure. Size is necessary, not sufficient.

Not proved: proof of reserves equals safety

Binance published an updated proof of reserves after the incident, showing 100% backing for major assets including BTC, ETH, USDT, BNB, SOL, USDC, XRP and others. But a PoR has three inherent limits:

It is a snapshot, not a live feed. Assets and liabilities can change after the snapshot.
It usually covers only the asset side. If the platform has off-balance-sheet liabilities, rehypothecated assets or undisclosed borrowing, 100% asset coverage does not mean positive net equity.
It relies on the platform's own liability data. Users can verify that their balance is included in the Merkle tree, but they cannot independently verify that no other liabilities were omitted.

Use a PoR correctly: look at the trend, not a single point; look at the coverage ratio, the snapshot date and the liability methodology. One 100% snapshot is less convincing than eight consecutive quarters at 100%.

Not proved: withdrawals will not freeze on you

Withdrawals were paused for days. For a long-term holder that may be an inconvenience. For a market maker, an arbitrage trader or someone who needs to post margin, it is a real loss. Custody risk is not only "the coins are gone"; it is also "the coins are there, but you cannot move them when you need them."

Exchange vs self-custody: risk is reallocated, not removed

Exchange custody and self-custody are not "safe vs unsafe." They are two different ways of allocating risk. Framing them as opposites leads to two equally dangerous conclusions: "move everything to a cold wallet" or "the exchange is convenient, so keep everything there."

Risk	Exchange custody	Self-custody wallet
Private-key loss	Platform's responsibility; you only need login and 2FA	Your responsibility; loss is usually permanent
Hacking	Platform hot wallets, insiders, signing infrastructure	Your device, browser extensions, signed approvals
Freezing	Platform risk controls, court orders, regulators	Nobody can freeze it, though on-chain blacklists can affect assets
Insolvency / exit scam	You become a creditor in a bankruptcy queue	Not applicable; assets stay on-chain
Operational error	Platform UI reduces wrong-address risk, but network selection is still on you	Address, network and gas are entirely on you
Physical coercion	Platform does not expose your home address	Large holders can be targeted
Recoverability	Depends on platform assets and jurisdiction	Depends on your backup; if the backup exists, you can recover

A practical rule: an exchange is for money you plan to trade or earn on in the near term; self-custody is for money you do not intend to touch for six months or more. The split is not a matter of ideology; it is a matter of liquidity needs.

What users actually recovered when exchanges failed

"Exchange failure" can mean wildly different outcomes. The deciding factors are how many assets remain, whether there is a bankruptcy process and whether users file claims in time — not brand recognition.

Event	Year	Scale	User outcome	Lesson
Mt. Gox	2014	About 850,000 BTC missing	Bankruptcy dragged on for a decade; repayments began in 2024	Centralized custody plus long-term misuse; recovery measured in years
QuadrigaCX	2019	About C$190 million	Founder died, keys disappeared, most funds never recovered	One person controlled the keys; no segregation
FTX	2022	About $8 billion hole	Fifth distribution in 2026; more than $10 billion distributed cumulatively; some classes recovered up to 120%	Recoverable assets plus a bankruptcy process can return most value
Bybit	2025	About $1.46 billion	Restored 1:1 reserves within 72 hours; users did not lose principal	Reserves plus a fast recapitalization prevented a run
Binance	2026	About $6.3 billion	90% replenished within two days; full coverage pledged; withdrawals paused for days	Own funds, SAFU and frozen assets helped, but liquidity still froze

FTX's 120% recovery is often misread as "you can profit from an exchange collapse." What actually happened is that the hole was estimated at about $8 billion at 2022 prices; the estate recovered assets, and crypto prices rose, so some USD-denominated classes recovered more than 100%. If you needed the money in 2022 and got it in 2026, the time cost and opportunity cost were not compensated.

8 exchange checks you can run without insider access

You cannot audit every liability of an exchange, but eight public signals can eliminate the obviously weak ones. Each item below has a "how to check" and a red flag.

#	Check	How to check	Pass condition	Red flag
1	Proof of reserves	Exchange PoR page, third-party audit	Coverage ≥100%, snapshot within 3 months, liability methodology disclosed	Asset addresses only, no liability data; long gaps between updates
2	Safety fund	SAFU / insurance fund page	Size, asset composition, custodian and payout rules disclosed	"We have a fund" with no size or custodian
3	Licenses and regulation	Compliance page, regulator registries	Clear license in major markets (MiCA, Hong Kong VASP, ADGM, etc.)	"Regulated" with no license number
4	Withdrawal history	Status page, community reports, past announcements	No prolonged platform-wide withdrawal pauses	Frequent "maintenance," clustered withdrawal complaints
5	On-chain reserves	DefiLlama, Arkham, Etherscan	Hot-wallet balances consistent with business scale; no sudden drain	Reserves collapse without explanation
6	Asset segregation	Regulatory disclosures, bankruptcy-remoteness arrangements	Customer assets segregated from corporate assets	Customer assets used for operations or related-party lending
7	Insurance	Exchange and custodian disclosures	Third-party insurance or a clearly defined compensation fund	Marketing a "safety fund" as deposit insurance
8	Exit capacity	Test a withdrawal and a fiat off-ramp	Small withdrawals reliable, timing predictable, fiat rails working	Limits change frequently; fiat withdrawals queue for weeks

How to use the table: do not score platforms and pick the highest. First eliminate any platform with a red flag on any item, then choose among the rest based on your needs. No platform deserves 100% of your assets.

The withdrawal drill: test the exit before you need it

Exit capacity is the most overlooked and easiest-to-verify part of exchange risk. Most people discover a limit problem, a wrong network, a missing whitelist or a queued fiat ramp only when they urgently need the money.

Step 1: Send a small test withdrawal

Withdraw 10–20 USDT to your own wallet and complete the full flow:

choose the network (TRC20, ERC20, BEP20, Solana, etc.) and confirm the receiving side supports it;
after pasting the address, verify the first six, last six and a middle segment;
if the chain requires a memo/tag, confirm it is correct;
record the submission time, arrival time and fee.

Step 2: Record your "normal state" baseline

Screenshot the timing, fee and limits. If withdrawals later take longer, limits drop or support starts sending templates, you have a baseline to compare against.

Step 3: Pre-approve a whitelist

Add your cold wallet and fiat off-ramp addresses to the withdrawal whitelist in advance. New addresses usually have a 24- to 48-hour cooling period. Do not add them on the day of a crisis.

Step 4: Decide what to do with locked assets

If you hold futures positions, earn products or Launchpool stakes on the exchange, those cannot necessarily be withdrawn immediately. Decide in advance:

Do I close futures first or withdraw spot first?
Can the earn product be redeemed early, and how many days does it take?
Can locked assets still be managed while withdrawals are paused?

A withdrawal drill is not a wish for failure. It turns "I think I can get my money out" into "I have confirmed I can."

Seven warning signs: three means act

Exchanges rarely announce trouble in advance, but they leave traces. One signal may be a coincidence; three or more should be treated as a reason to consider moving assets.

#	Warning sign	Why it matters
1	Withdrawals stuck in "processing" for a long time, or rejected without explanation	The most direct liquidity signal
2	Support gives only templates and no timeline	The front line either lacks authority or will not commit
3	On-chain hot-wallet reserves drop sharply in a short period	Large transfers out or a run in progress
4	Executives, auditors or custodians leave in a cluster	Insiders often see problems first
5	Sudden yields far above market	Paying up for deposits can signal a funding gap
6	Frequent changes to withdrawal limits, KYC or supported regions	Common under regulatory pressure or cash stress
7	Heavy reports of failed withdrawals, with official silence or deleted posts	Lack of transparency accelerates a run

Order of action: move the most liquid assets first (USDT, BTC, ETH), then small caps; test small before moving large; send to a self-custody wallet rather than only to another exchange. If several platforms show the same signals at once, prioritize self-custody capacity instead of moving from one exchange to another.

If it is already happening: a 30-minute action list

The goal of the first 30 minutes is to control what can still be controlled. Do not start with support arguments or social media posts.

0–10 minutes: confirm the scope and available channels

Is this a platform-wide pause, or maintenance on one asset or chain?
Are deposits working? Is spot trading working? Can futures positions be closed?
What do the official announcement and status page say? Is there a recovery time?

10–20 minutes: withdraw what you can

Prioritize USDT, BTC, ETH and other liquid assets;
test with a small amount before moving the rest;
send to a wallet you control, not only to another exchange;
if withdrawals are blocked, try convert, fiat off-ramp or C2C alternatives.

20–30 minutes: preserve evidence and prepare claims

Screenshot balances, positions, trade history and withdrawal records;
export CSV statements;
record support ticket numbers, announcement links and timestamps;
if the platform has clearly failed, prepare claim materials: ID, account proof, asset snapshot and transaction history.

Do not: leak account details in community chats; trust "paid withdrawal acceleration" or "internal unfreeze channels"; hand your 2FA code or password to anyone.

What the law does and does not give you

In most jurisdictions, an exchange customer is an unsecured creditor, not an insured depositor. That single fact explains why recoveries vary so much.

The US: crypto held at an exchange is generally not covered by FDIC deposit insurance or SIPC brokerage protection. Some custody products may carry private insurance, but it is product-specific and rarely covers a full-platform failure. State money-transmitter licenses and FinCEN MSB registration are AML rules, not solvency guarantees.
The EU: MiCA requires crypto-asset service providers to segregate client assets and maintain safekeeping arrangements. Segregation improves the odds that customer assets are identifiable in an insolvency, but it is not deposit insurance, and enforcement varies by national regulator.
The UK: FCA registration and financial-promotion rules apply, but crypto is not covered by the Financial Services Compensation Scheme in the same way as bank deposits.
Offshore entities: many exchanges operate through entities in jurisdictions with limited public insolvency track records. Where the entity is registered determines which court, which priority rules and which regulator you deal with.
Restricted jurisdictions: if local rules prohibit crypto trading or prohibit offshore platforms from serving residents — mainland China is the clearest example — your practical remedies are even thinner, because the underlying service contract may be unenforceable.

The practical takeaway is not "don't use exchanges." It is "do not assume someone will make you whole." In that world, controlling exposure matters more than studying recovery procedures.

How much to keep where: tiers by purpose and size

There is no universal allocation, but there is a workable starting point: a loss at any single venue should not be life-changing. The framework below splits by purpose and by size.

By purpose

Purpose	Where	Reference share	Why
Long-term holdings (6+ months untouched)	Hardware / cold wallet	70%–80%	Not exposed to platform risk
Daily interaction, payments, airdrops	Hot wallet	5%–10%	Convenient, but keep it small
Trading and earn products	Exchange	10%–20%	Needs liquidity and trading features
Emergency liquidity	Stablecoins + fiat	5%–10%	Avoid forced selling during a crisis

By size

Total portfolio	Suggested setup	Additional actions
Under $1,000	Exchange + hot wallet	2FA, monthly withdrawal check
$1,000–$50,000	20% exchange + 10% hot wallet + 70% cold wallet	Withdrawal drill, whitelist, quarterly recovery drill
Over $50,000	No more than 20% on exchanges; the rest self-custodied	Multisig/MPC, geographic diversification, inheritance plan, professional security audit

You can adjust the percentages, but keep one floor: if your exchange balance is more than 50% of your total, move at least half to self-custody. Not because the exchange will necessarily fail, but because you cannot withdraw when it pauses.

If you keep using exchanges, do these 6 things

If you decide to stay, these six controls are the minimum. They do not remove platform risk, but they reduce the damage from "platform failure plus account compromise."

Turn on 2FA, preferably an authenticator or passkey, not SMS. Enable the anti-phishing code too.
Set a withdrawal whitelist and cooling period. Add addresses in advance, not during an emergency.
Use least-privilege API keys. Disable withdrawals, bind an IP allowlist, delete unused keys.
Use a dedicated email and a unique password. Do not reuse your social, gaming or forum email.
Run a monthly withdrawal drill. Send a small amount and record timing and limits.
Do not keep everything on one exchange. Use at least two, and keep part of your assets in self-custody.

For the exact settings, see the Binance account security guide and the personal Web3 security checklist.

💰 Binance rebate: invite code BINANBT

New users who enter invite code BINANBT at registration get a 20% trading-fee rebate — worth having if you trade regularly. This article contains a referral link; we may earn a reward if you register through it, at no extra cost to you.

Rebate: 20% of trading fees, ongoing; the more you trade, the more you save.
Welcome package: up to $19,800, unlocked through tasks, not paid as cash on signup.
How to claim: enter BINANBT in the invite-code field at registration; that is the most reliable way.
Important: registering directly in the app gives you none of the new-user rewards. An in-app signup is not linked to any invitation, so the $19,800 package and the 20% fee rebate will not apply. Use the registration link or enter invite code BINANBT.

👉 Register on Binance and claim the 20% fee rebate

FAQ

Is it safe to keep crypto on an exchange?

There is no absolute safety. Crypto held on an exchange is legally a claim on the platform, not an asset you control directly. When the platform is healthy it is convenient; when it is hacked, frozen or insolvent, how much you recover depends on its balance sheet, its regulator and the bankruptcy process. A more resilient approach is to tier your holdings: keep only trading capital on exchanges, hold long-term assets in self-custody, and rehearse withdrawals before you need them.

If an exchange collapses, can I get my money back?

It depends on how many assets remain, where the entity is registered and whether you file a claim in time. FTX had recoverable assets and a bankruptcy process, and creditors received distributions in 2026. Mt. Gox creditors waited about a decade. QuadrigaCX's keys died with its founder, and most funds were never recovered. In most jurisdictions, exchange customers are unsecured creditors, not depositors with insurance.

Is Binance safe for holding crypto?

Binance is one of the largest exchanges, with proof of reserves, a roughly $1 billion SAFU fund and a regulated custody arrangement in ADGM. In the October 2026 incident it pledged company funds to cover user losses. But the same incident showed that even a top platform can pause withdrawals, that proof of reserves is a snapshot, and that SAFU payouts are discretionary. The conclusion is not "unsafe"; it is "do not put all your assets and all your liquidity on any single platform."

What does proof of reserves actually prove?

Proof of reserves shows that, at a point in time, the on-chain assets controlled by the platform meet or exceed user liabilities, typically using a Merkle tree or zero-knowledge proof so users can verify their balance is included. It does not prove the absence of off-balance-sheet liabilities, that assets are not rehypothecated, or that withdrawals will work tomorrow. Read a PoR report together with its snapshot date, coverage ratio and liability-side methodology; missing any of the three weakens the signal.

What should I do if an exchange pauses withdrawals?

First separate a platform-wide pause, a single-asset maintenance window and a risk-control freeze on your account. In a platform-wide pause, preserve evidence, follow official announcements, avoid duplicate requests and ignore paid "acceleration" offers. If reserves are falling, support is unresponsive and executives are leaving at the same time, move whatever you can to self-custody and prioritize the most liquid assets.

Are exchange balances insured like bank deposits?

Usually not. In the US, crypto held at an exchange is generally not covered by FDIC deposit insurance or SIPC brokerage protection, even when the exchange advertises "insurance" for certain custody products. In the EU, MiCA imposes segregation and safekeeping requirements, but that is not the same as deposit insurance. Some platforms run their own compensation funds, but those are discretionary and usually too small to cover a full-platform failure.

Contents