Guide · Risk Management
Crypto Exchange Hacks: What Happens to Your Coins
When a crypto exchange is hacked, it usually pauses withdrawals, freezes what it can trace and decides who bears the loss. Here is how that process works, using Binance's October 2026 incident, and what it means for coins held on a platform.
A crypto exchange holds its customers' coins in wallets it controls. Most of the balance sits in cold wallets, whose keys are kept offline, and a smaller part in hot wallets connected to the internet so that withdrawals can be processed quickly. An exchange hack is almost always an attack on that hot side, or on the systems that authorise transfers out of it: stolen keys, a compromised employee device, or a flaw in the software that signs withdrawals. Once coins leave on a public blockchain, they cannot be recalled by the exchange.
The first response is nearly always the same: pause withdrawals. Stopping outgoing transfers prevents further losses while the exchange works out what was taken and how, but it also means every customer, not only those affected, is temporarily unable to move funds. Deposits may be paused too, then reopened earlier. Trading often continues, so prices keep moving while users cannot leave the platform, which is why a pause usually comes with a sharp move in the exchange's own token and in the wider market.
The second step is tracing and freezing. Blockchain analytics firms follow stolen coins from address to address, and some of them can be blocked. Issuers of centralised stablecoins, chiefly Tether (USDT) and Circle (USDC), can freeze tokens at a specific address, and other exchanges can lock deposits that arrive from flagged wallets. Bitcoin and ether themselves cannot be frozen on chain, so attackers typically swap stolen stablecoins into them, or route funds through mixers and bridges, as fast as they can.
Binance's incident of October 29, 2026 is a recent example. The exchange suspended withdrawals late that Thursday after a security incident it estimated affected about $6.3 billion of assets, with Coinglass data showing roughly $1.66 billion of USDT, 17,985 bitcoin and $767 million of USDC among the drained funds. Its initial investigation pointed to a compromised engineer's laptop rather than a leaked wallet key. Within hours it said about $3 billion had been frozen with partners; Circle froze more than $800 million of USDC and Tether more than $1.5 billion of USDT. Binance said customers would be made whole from its SAFU fund and its own money, deposits reopened the next day, and bitcoin fell below $78,000 while withdrawals stayed paused.
Who bears the loss depends on the exchange's balance sheet. Binance created SAFU, its Secure Asset Fund for Users, in 2018 and used it after a 2019 hack of about 7,000 bitcoin. Bybit covered the roughly $1.5 billion stolen from it in February 2025, which the FBI attributed to North Korea, with its own capital and loans from other firms. Others could not: Mt. Gox lost about 850,000 bitcoin in 2014 and creditors waited a decade for partial repayment, and Bitfinex in 2016 spread a loss of about 120,000 bitcoin across all customers with a 36% haircut, repaid later through tokens it issued. FTX's collapse in 2022 was not a hack but showed the same risk: customer coins were not there when they were needed.
Three habits reduce the exposure. Keep only what you trade on an exchange and move longer-term holdings to a wallet whose keys you control. Check whether the platform publishes proof of reserves and has a fund or insurance arrangement, and how large it is relative to deposits. And when a pause is announced, read the exchange's own statements rather than social media: the questions that matter are whether the loss is covered, when withdrawals reopen, and whether the exchange's own token, whose price often falls hardest, is part of what you hold.