The $6.3 billion Binance hack did not start with a customer’s stolen password. Attackers got into the exchange’s own systems and drained its internet-connected hot wallets on 10 blockchains. Nothing an individual customer did would have stopped it.
Good crypto wallet security still matters, though. It decides how exposed you are when a platform fails, and how well you hold up against the scams that follow.
This guide draws on what US agencies tell consumers. That means the SEC’s custody bulletin, FBI crime alerts, and advice from CISA and the FTC. None of it is investment advice.
What the Binance hack shows about exchange custody
Binance puts the October 29 theft at about $6.3 billion, the largest crypto heist on record. We covered what happened and the US fallout in our Binance hack explainer. The short version is that the attack hit the exchange’s own systems, not users’ accounts.
Blockchain analytics firm TRM Labs said the attacker prepared for at least 36 hours. Most of the money then left in about 20 minutes. In TRM’s assessment, the pattern “points to a compromise of Binance’s hot wallet signing infrastructure.” The FBI has blamed North Korea’s TraderTraitor group. It named the same unit for the $1.5 billion Bybit theft in 2025.
So far Binance customers have come through whole, because the exchange is paying. It said it had covered about 95% of the impacted amount, and it reopened withdrawals on November 1, CNBC reported. Customers pulled out $4.65 billion in the first nine and a half hours.
That outcome depended on one company having billions on hand. A smaller platform might not. The SEC spelled out that risk in a December 2025 custody bulletin for retail investors. If a custodian “shuts down, or goes bankrupt,” or is hacked, it says, “you may lose access to your crypto assets.”
There is no federal backstop either. The FDIC’s fact sheet on crypto companies says its insurance does not cover the failure “of any non-bank entity.” It names crypto exchanges, custodians and wallet providers.
Hot wallets, cold wallets and who holds the keys
A crypto wallet does not hold coins. It holds the private key that authorizes moving them. The SEC bulletin likens a private key to a password. Unlike a password, it “cannot be changed or replaced.”
A hot wallet stays online, as a phone app, desktop program or web wallet. The SEC says hot wallets are convenient “but they also expose your crypto assets to cyberthreats.” A cold wallet is usually a physical device kept offline. The SEC calls it “generally more secure from cyberthreats.” But a device that is lost, damaged or stolen “may result in a permanent loss,” it warns.
The bigger choice is who holds the key. With third-party custody, an exchange or custodian controls the private keys. It may keep your assets in hot wallets, cold wallets or both.
With self-custody, you control the keys, and the SEC stresses you then have “sole responsibility” for them. If you lose the wallet or its recovery words, no help desk can restore them.
Neither option is safe by default. Exchange custody concentrates risk in a company you cannot audit. Self-custody moves it onto you.
One middle path is a trading balance on an exchange, with longer-term holdings in a wallet you control. That caps how much rides on any one platform.
Questions to ask before you leave money on an exchange
If you keep crypto with a platform, the SEC suggests asking it directly how it protects your holdings. Its bulletin lists questions to put to any custodian:
- Does it use hot wallets, cold wallets or both, and which more?
- Does it store assets itself or subcontract storage to someone else?
- Does it offer insurance for loss or theft, and on what terms?
- Does it lend customer assets out (rehypothecation) or pool them (commingling)? Does it need your consent?
Those answers matter more after a hack like Binance’s than any marketing about security. A platform that keeps most customer assets in cold storage has less exposed in hot wallets like the ones drained on October 29.
Americans also have a narrower set of platforms to choose from. Binance’s main exchange agreed in its 2023 settlement with the Treasury Department to stop serving US customers. Binance.US is a separate company, and it said it was not affected.
Lock down the account you do control
You cannot fix an exchange’s signing system, but you can make your own account much harder to take over.
Start with sign-in. CISA’s guidance on multifactor authentication names FIDO/WebAuthn as the only widely available phishing-resistant option. In practice that means passkeys and hardware security keys. CISA also says “any MFA is better than no MFA.”
Text-message codes are weaker. In a SIM swap, a criminal talks a carrier into moving your number to their phone.
The FBI’s SIM-swap alert counted 1,611 complaints and more than $68 million in losses in 2021 alone. It advises “strong multi-factor authentication methods such as biometrics, physical security tokens” and not advertising your financial assets.
Next, turn on a withdrawal allowlist. Many exchanges let you restrict withdrawals to addresses you have approved in advance. Binance.US says its version “prevents withdrawals” to any address you have not already marked as your own. An intruder in your account then has to change that list before sending funds anywhere.
Then guard the seed phrase. The seed phrase is the set of words that restores a wallet. The SEC’s advice is to store it securely and “not share it with anyone.” No legitimate exchange, wallet maker or support agent needs it. Anyone asking for it, for any reason, is trying to take your money.
Finally, keep devices current. CISA’s phishing guidance says “don’t delay software updates,” since unpatched flaws give criminals a way into accounts.
The scams that follow a big hack
Every major theft brings a second wave of fraud aimed at worried customers. Security firm Malwarebytes warned Binance users the day after the hack. Avoid logging in through unexpected messages that ask you to “urgently verify your account or claim compensation,” it said. Binance has said it is covering the loss itself, so no customer needs to click a link to be repaid.
CISA says to check any message through a channel you already trust. That could be an app you installed or a web address you type yourself.
It also notes that AI tools make phishing messages look polished, so clean grammar proves nothing. We explained one common trick, a fake CAPTCHA that installs malware, earlier this month.
Recovery scams are the other trap. The FBI has warned about fake firms that promise to get stolen crypto back for a fee.
“Law enforcement does not charge victims a fee for investigating crimes,” the alert says. Private recovery firms also cannot issue seizure orders.
The stakes are high because, as the FTC’s crypto scam guide puts it, “cryptocurrency payments typically are not reversible.” The FTC adds that “only scammers demand payment in cryptocurrency.”
Where to report a theft or scam
If you lose crypto to a scam or account takeover, report it to the FBI at ic3.gov and to the FTC at ReportFraud.ftc.gov. Type both addresses yourself. Tell the exchange you sent the money from as well. Keep the wallet addresses, transaction details and every message, which the FBI asks victims to document.
For Binance customers, the next marker is the post-mortem the exchange has promised once its investigation is complete. That report should say how the attackers reached its signing system. It should also show whether Binance will keep less in hot wallets.
