Binance, crypto and hacks: What to know about keeping coin safe as cyber criminals advance

For generations, most Americans have deposited their money in banks knowing that if somehow things went sideways, their funds would be covered by the full force of the government's treasury. Up to $250,000 in losses are covered through the Federal Deposit Insurance Corporation (FDIC), born out of the ashes of the Great Depression. Crypto investors are probably wishing for an FDIC equivalent after Binance, the world's largest crypto exchange, was hacked on Oct. 29, with an estimated impact of $6.3 billion, raising questions about the recovery of stolen funds and the broader fallout for crypto markets. About $3 billion of the stolen assets has been frozen so far, according to a Binance security update. The exchange pledged to cover all losses. Blockchain investigators at TRM Labs and Chainalysis have linked the attack to North Korea, but neither the U.S. government or Binance has publicly confirmed any source for the hack. "We are committed to covering all hacked losses through our company funds. Your assets are safe," Binance co-CEO Richard Teng said in a post on X. Understanding how crypto is protected online and what mechanisms exist to serve a role similar to insurance is increasingly important as more Americans invest in cryptocurrency. Roughly one in five U.S. adults say they have invested in, traded, or used crypto, according to Pew Research Center, a figure that is even higher among upper income households (27%). The Securities and Exchange Commission's research from 2024 and 2025 puts that figure closer to 15%, and estimated that roughly 9% of the investing public owned crypto at the time of its survey. Its survey work indicates cryptocurrency ownership is more common for younger individuals, men, and those with higher risk tolerance, but also possessing higher financial literacy. While Binance has pledged to cover all losses, that isn't the same as being legally bound. "Binance says it will cover all losses from the SAFU fund and the company's funds, and that there's no evidence of a wallet private-key leak. That's a pledge until there's an actual payout," said Nikolas Behar, a cybersecurity expert and professor at the University of San Diego. Similar pledges have followed other crypto compromises. After rogue overseas support agents were bribed to steal customer data in May 2025, Coinbase said it would reimburse customers who lost money to the resulting scams. "We will reimburse customers who were tricked into sending funds to the attacker," the company said in a blog post. If something happens to your crypto, most consumers are left to navigate a patchwork of options that vary from exchange to exchange and are often very ambiguous. Many exchanges say customers will be paid back if something goes wrong. Josephine Wolff, professor of cybersecurity policy at The Fletcher School at Tufts University, said there "really aren't any legal protections for crypto assets equivalent to FDIC insurance." Customers could try to sue a hacked exchange, she said, for instance by claiming it was negligent, or may recover some funds if the exchange declares bankruptcy, as happened with FTX. But "there's no guarantee of compensation," she said. Michael Tanguma, co-founder and CEO of Onramp Bitcoin, a bitcoin financial services and custody firm, said that when an exchange is hacked, customers are usually repaid, "but only because the exchange decides to pay and has the money to do so." "Nothing in the law requires it to," Tanguma said. "Some stolen funds can be frozen. Tether and Circle, the companies behind the two largest dollar-backed tokens, froze billions of dollars of this week's stolen money, and law enforcement occasionally recovers assets years later," Tanguma said. But he added that bitcoin has no company behind it that can freeze it, so once it leaves your control, it is almost always gone. Customers who lose funds individually are in a very different situation than those caught up in an exchange attack. "When your own account is compromised, through a stolen password, a phishing link, or a hijacked phone number, the outlook is much worse," Tanguma said, noting that exchanges generally treat those losses as the customer's problem, and because crypto transactions are final once confirmed, there is no bank to call and no charge to dispute. Storing your own digital currency Tanguma said keeping coins offline can protect against the kind of attack that hit Binance, though there are other risks associated with this digital security approach. "The stolen funds came from wallets the exchange keeps connected to the internet to process everyday withdrawals, not from its offline reserves," Tanguma said. But he added that the details of this hack point to a larger problem. "Binance says no keys were leaked. The attackers manipulated the system that approves withdrawals, the same approach used in last year's $1.5 billion theft from Bybit, which targeted a transfer out of cold storage," Tanguma said, noting that every custody setup has a weak point, and in most of them it is a single one. "On an exchange, that point is the company: its employees, its approval systems, its finances, and its willingness to repay you," Tanguma said. When you hold your own coins, he said, that point is you: a lost device, a backup found by the wrong person, a tampered device bought from an unofficial seller, a transaction approved under pressure, or a family unable to reach the funds after a death. "Moving savings off an exchange trades one kind of risk for another. It does not remove risk," Tanguma said. The chances of getting money back after a crypto hack Sarah Downey, executive vice president and global blockchain and digital assets advisory leader at Lockton, an insurance brokerage, said other factors also come into play in determining whether you can get your crypto back, including how quickly the theft is discovered, where the funds were moved, whether the exchange or wallet provider has insurance that covers the event, and whether it holds enough reserves to repay customers. "Some companies have set up FDIC-like insurance or other backstops, but whether these pay out depends heavily on the facts of each case. Even without insurance, many exchanges try to repay customers from their own reserves to protect both their customers and their own reputation," Downey said. Bitget, another major exchange, had to tap an in-house fund to reimburse customers after a $388 million hack in September. Bitget CEO Gracy Chen said its User Protection Fund, which held more than $464 million, covered the loss. "The Protection Fund was created for moments like this and absorbed the financial impact of the incident," Chen said in a post on X. By comparison, Binance's emergency reserve, the Secure Asset Fund for Users, or SAFU, is estimated at roughly $1 billion to $1.2 billion, and excluding the funds that were frozen, this would represent about one-third of the loss. In an update from Binance on Oct. 30, the company said it had set aside more than $6.34 billion in company funds and already held more than $5 billion in corresponding token assets. Downey said the steps to take if your crypto is hacked depend on whether investors self-custody or use a third party, such as a regulated exchange. "If they use a third party, they should check that most funds are stored offline or protected with multi-party computation. An investor's own funds should also be stored separately from the exchange's own funds," Downey said, adding that customers should also understand how the custodian authorizes transactions and governs storage. Ryan Reck, founder and principal of Reck Advisory, an independent cybersecurity advisory firm, points to the lack of oversight of crypto. "Crypto has no undo button. Once a transfer confirms, there's no chargeback and no one who can reverse it," Reck said. In some cases, stolen funds can be frozen by an exchange that receives them, or by a stablecoin issuer at a specific blockchain address, but tracing the money and getting it back are two different things. Among the common reasons investors cite for making crypto investments is diversification away from traditional assets, as well as use of crypto as a digital version of gold, investing in the decentralization of finance theme, and betting that as more institutions adopt digital currencies, that will serve as a tailwind. And there's of course also speculation. Today, there are ways to invest in crypto that don't require holding the underlying currency in a wallet, such as exchange-traded funds, such as the iShares Bitcoin Trust (IBIT), which has over $62 billion in assets. For investors who want to hold crypto directly, Reck says that before trusting any platform, ask four questions: - What's covered? - What's excluded? - How much coverage exists for all customers combined? - Do I have an enforceable right to be repaid? "'Insured' is where the conversation starts, not proof your money is protected," Reck said. —CNBC's Jenny Lee contributed reporting