Is Crypto Safe on an Exchange? Lessons From the 2026 Hacks

By VoxTradePro Editorial Team · Published 2026-11-03 · Updated 2026-11-08 · 9 min read

In just six weeks, three large exchanges reported thefts from their hot wallets. On 24 September 2026, attackers took about $387.5 million from Bitget. On 29 October they took about $6.3 billion from Binance, the largest crypto theft on record. On 2 November, Brazil's largest exchange, Mercado Bitcoin, lost an estimated $40–49 million. Google searches for "Binance hack" and "bitcoin hack" surged in the following days, and many people are asking a simple question: is it still safe to keep crypto on an exchange?

This guide explains, in plain English, how these hacks happened, who paid for the losses, what "proof of reserves" does and does not prove, and how to reduce your own risk. It is educational, written for readers worldwide, and is not financial, legal or security advice. For the market reaction, see our news report on Bitcoin after the Binance hack. Live prices are on our Bitcoin, Ethereum and BNB pages.

What happened in the three 2026 exchange hacks

Exchange	Date (2026)	Estimated amount	What was hit	Who covered users
Bitget	24 September	About $387.5 million	Some hot and warm wallets	Bitget said its User Protection Fund would cover the loss
Binance	29 October	About $6.3 billion (Elliptic: $6.43 billion)	Hot wallets on 11 blockchains	Binance said its SAFU fund and company money would cover it
Mercado Bitcoin	2 November	About $40–49 million	Hot wallets only, per the exchange	The exchange said clients would not lose assets

Binance. Blockchain analytics firm Elliptic counted $6.43 billion stolen as hot wallets on 11 blockchains were drained within a few hours. Binance first linked the breach to a compromised engineer's laptop, then said it had found "additional points of breach". TRM Labs told Reuters that the attackers had compromised Binance's "signing infrastructure", the system that authorises transactions. The FBI attributed the theft to North Korea's TraderTraitor group, which North Korea denied, CNBC reported.

Bitget. Bitget's incident update confirmed about $387.5 million moved to attacker addresses across Ethereum and other EVM networks, XRP Ledger, Zcash and TRON. Chainalysis attributed it to North Korea-linked actors.

Mercado Bitcoin. The exchange's official update said only hot wallets were affected, that about $11 million had been blocked with help from Tether, Circle and others, and that clients would not lose assets. CoinDesk reported that how the attacker got signing access was still unknown, and that there was no public evidence linking it to the Binance attack.

The common thread: hot wallets and signing systems

An exchange does not keep all customer coins in one place. Most sit in cold wallets, with keys kept offline. A smaller amount sits in hot wallets, online and ready to pay out withdrawals. Mercado Bitcoin described this as the shop's cash register (hot) versus the vault (cold).

In each 2026 case, the losses came from the online side. Reports point to attackers getting into the systems that approve and sign withdrawals, rather than breaking the blockchain itself. CoinDesk said the Mercado Bitcoin transfers were "plain transactions, not a smart contract exploit". The lesson for users: an exchange's security depends heavily on its internal controls, its staff devices and its signing process. Users cannot see any of these.

Regulators noticed. On 2 November, South Korea's Financial Services Commission called an emergency meeting with local exchanges and urged them to raise the share of assets in cold storage, step up round-the-clock monitoring and build extra reserves (FSC, in Korean). Korean rules already require at least 80% of customer crypto to be held cold. According to Cointelegraph, end-September ratios ranged from 80.54% to 99.17% across major local exchanges.

Who pays when an exchange is hacked?

In all three cases, the exchange said it would cover customers from its own funds:

Binance said it set aside more than $6.34 billion from its SAFU emergency fund and company money. It reported that coverage reached about 90% by 31 October and about 95% by 1 November, and it reopened withdrawals in phases from 1 November (CNBC, Unchained).
Bitget said its User Protection Fund, reported at more than $464 million, would cover the full loss (Decrypt).
Mercado Bitcoin said clients would not lose assets.

That is reassuring, but there is an important limit. A pledge is only as strong as the company behind it. A large, well-capitalised exchange can absorb a loss that would sink a smaller one. Even when balances are protected, users can still face paused withdrawals for days: Binance, Bitget and Mercado Bitcoin all halted withdrawals while they investigated. If you needed your money during that window, you had to wait.

Why some stolen crypto can be frozen

About half of what was taken from Binance was in stablecoins. Elliptic verified about $2.85 billion (44%) of the theft as frozen or seized, almost all of it USDT and USDC. Issuers such as Tether and Circle can block tokens at an address; Tether alone froze over $9 million in the Mercado Bitcoin case, Chainalysis said. Bitcoin and ether cannot be frozen by an issuer, which is why attackers race to swap stablecoins into them. The same power works both ways: our DEX comparison explains that issuers can freeze ordinary holders' stablecoins too.

What proof of reserves can and cannot tell you

After the hack, Binance completed a zero-knowledge proof of reserves for a 31 October snapshot covering 10 tokens: BNB, BTC, ETH, RLUSD, SOL, USD1, USDC, USDT, XRP and ZEC. It planned a wider snapshot on 4 November (Unchained; Binance PoR page). A Merkle tree lets each user check their account was counted, and a cryptographic proof shows reserves covered what users were owed at that moment.

Proof of reserves is useful, but it is a snapshot. It does not prove security, it does not cover every token, and it says nothing about what happens after the snapshot. Treat it as one sign of good practice, not a guarantee.

Exchange custody vs self-custody: the trade-off

	Coins on an exchange	Coins in your own wallet
Exchange hack	Exposed; depends on the exchange covering losses	Not exposed
Withdrawal pause	Possible during incidents	Not applicable
Lost password or 2FA	Usually recoverable through support	Lost seed phrase usually means lost coins
Phishing and fake apps	Account takeover risk	Wallet-drain risk
Convenience	High: fast trading and fiat on-ramps	Lower: you manage keys and fees

Decentralised exchanges are a middle path for some traders, but many are not fully decentralised; our comparison of six DEXs and reviews of Hyperliquid, Aster and GMX cover who can still freeze or block funds there.

A practical safety checklist

Keep only trading money on an exchange. Move longer-term holdings to a wallet you control, if you are confident managing keys.
Spread risk. Do not keep everything with one company.
Check the exchange's protection fund and reserves. Look for published proof of reserves and how often it is updated.
Use strong account security. Use an authenticator app or hardware key rather than SMS, and set withdrawal address allow-lists where offered.
Use official channels only during incidents. Mercado Bitcoin warned it never asks for passwords, codes or recovery phrases and does not offer refunds via links, WhatsApp or calls. Scammers target users after every hack.
Plan for delays. Do not hold money on an exchange that you may need urgently; withdrawals can pause.
Size trades sensibly. See risk management basics and crypto market basics.
Follow local rules. Use exchanges that are permitted where you live, and do not try to get around restrictions.

Market snapshot

Markets have stayed cautious. Bitcoin traded near $76,960, down about 1.2% over 24 hours, and ether near $2,263, according to CoinGecko data at 12:08 UTC on 3 November 2026. Track live moves on our crypto prices hub and in crypto news.

Frequently asked questions

Did Binance users lose money in the October 2026 hack?

Binance said it would absorb the loss with its SAFU fund and company money, not users. It reported covering about 95% of affected assets by 1 November and resumed withdrawals in phases from 1 November. Check Binance's own announcements for the latest status.

What is the difference between a hot wallet and a cold wallet?

A hot wallet is connected to the internet so an exchange can process withdrawals quickly. A cold wallet keeps keys offline and is much harder to attack, but slower to use. The 2026 exchange hacks all hit hot or warm wallets.

Does proof of reserves prove an exchange is safe?

No. Proof of reserves can show that an exchange held at least as much of certain coins as it owed users at one moment. It does not prove the exchange will not be hacked later, and it usually covers only selected tokens.

Is self-custody safer than keeping crypto on an exchange?

It removes exchange hacks and withdrawal freezes from the list of risks, but adds others: lost seed phrases, phishing and signing a malicious transaction. Which is safer depends on how carefully a person manages their own keys.

What should I do if my exchange is hacked?

Follow only the exchange's official website, app and verified social accounts. Never share a password, 2FA code or recovery phrase, and ignore anyone offering refunds by direct message, WhatsApp or phone call.

Can stolen crypto be frozen?

Some of it. Stablecoins such as USDT and USDC can be frozen by their issuers, which is how large parts of the Binance and Mercado Bitcoin thefts were blocked. Bitcoin and ether cannot be frozen by an issuer once they are in a thief's wallet.