Is My Bitcoin Safe on an Exchange? What the Binance Incident Changes

The short answer

Is my bitcoin safe on an exchange? Only as safe as the exchange itself. When you hold bitcoin on an exchange, the exchange holds your private keys, so you do not have direct custody. Your balance is a claim on that company, and its security practices, reserves and any insurance decide what happens if something goes wrong. The 21Rates exchange comparison states this plainly and suggests considering withdrawal to self-custody after purchase.

That trade-off cuts both ways. Exchanges offer liquidity, simple interfaces and account recovery if you lose a password. Self-custody removes the company from the equation but makes you responsible for key backup. Neither model is universally correct. The right choice depends on how much you hold, how often you trade, and how much operational responsibility you want.

What happened at Binance, dated and attributed

On October 29, 2026 Binance confirmed a security incident to TechCrunch and said it temporarily suspended withdrawals on multiple networks as a precaution. Binance's October 30 statement put the estimated total impact at around $6.3 billion in client assets, with roughly $3 billion frozen on-chain. CNBC described it as the largest crypto hack on record. An earlier TechCrunch estimate of upward of $5.7 billion was unconfirmed and superseded by Binance's later figure.

On cause, the picture shifted. The initial statement described a possible compromised DevOps laptop. CNBC reports Richard Teng later described a more complex attack than misuse of one engineer's permissions. Binance says it has found no evidence of any wallet private key leak. CNBC reports TRM Labs and Chainalysis attributed the incident to North Korean actors, but that is their assessment, not confirmed attribution by Binance.

On reimbursement, Binance says it will cover all losses from the SAFU fund, created in 2018, and the company's funds. That is a company pledge, not independently confirmed reimbursement, and frozen assets are not recovered reimbursements. Binance's later October 30 statement says it has begun recovering affected assets and reserved company funds, while noting that recovered and frozen assets remain subject to ongoing recovery and verification and that public Proof of Reserves verification is still forthcoming.

On service status, CNBC reports a later statement by Yi He said deposits remained unaffected, with an expectation to begin resuming withdrawal services within the next 48 hours. That was a dated expectation, not confirmation. Current service status has not been established here, so check official Binance channels directly. Binance has also warned users to remain cautious of scams and not to trust unofficial links, messages, or requests for account information.

What this does and does not establish about other platforms

One incident at one company does not prove that every exchange, custodian or lender shares the same exposure. It does prove that the risk model is real: a platform holding keys for many clients is a concentrated target, and the outcome for customers depends on the company's response capacity, not on the blockchain itself.

The reasonable response is not to assume all platforms fail the same way. It is to check the specific protections of wherever you hold bitcoin:

• Key storage. TechCrunch describes hot wallets as internet-connected cryptocurrency wallets. Cold storage means private keys are held offline, disconnected from the internet. In the 21Rates custody comparison, dated October 29, 2026, the Cold Storage column reads 100% for Casa, Copper, Crypto.com, Fidelity Digital Assets, Komainu, Nunchuk, Onramp Bitcoin, River, Theya and Unchained.
• Proof of Reserves. In the same dated comparison, Proof of Reserves reads Yes for Crypto.com, Kraken, Onramp Bitcoin, River and Tetra Trust, and Yes (monthly) for Paxos. Binance's own public Proof of Reserves verification was still forthcoming as of its October 30 update.
• Insurance. Disclosed entries in the comparison include Crypto.com $750M (Lloyd's), Coinbase $320M, BitGo $250M (Lloyd's) and Gemini $200M+ via Nakamoto Ltd. These are dated disclosures, not independently verified policies, and the comparison notes that coverage terms vary and readers should confirm what assets and events are covered.
• Structure. Casa, Nunchuk and Theya list a self-custody model with no insurance because there is no custodian to fail. Unchained lists multisig, a signing arrangement that distributes key control. Multisig changes who can move funds; it does not remove counterparty or operational risk by itself.

Comparing where your bitcoin can sit

As of October 29, 2026 the 21Rates custody comparison tracked 23 custodians, 17 of them qualified. The lender comparison tracked 22 lenders, 14 custodial and 8 non-custodial. One featured example: Ledn's collateral is held with a qualified independent custodian, is never lent out to earn interest, and comes with a Monthly Open Book Report independently verified by The Network Firm LLP, with BitGo named as custodian in the dated table. That is one dated disclosure, not a guarantee about lending in general.

Safe withdrawal checks if you move funds

If you decide to withdraw to self-custody, treat the first transfer as a test. Send a small amount first and confirm receipt. Verify the address character by character, since clipboard malware exists. Set up your backup before the withdrawal, not after. Ignore any message claiming to be support that contacts you first; Binance's own warning about scam links and account-information requests applies broadly after any high-profile incident.

Questions to ask wherever you hold bitcoin

1. Who controls the private keys, and can I withdraw on my own schedule?
2. Is there Proof of Reserves, and how recent is it?
3. Is there disclosed insurance, and what assets and events does it cover?
4. For lending, is my collateral rehypothecated or held with an independent custodian?
5. What is the company's documented history of handling incidents and reimbursements?

The Binance incident is a stress test of one company's pledge. Your job is simpler: know which model your bitcoin sits in, and whether its protections are documented rather than assumed.

Frequently asked questions

Is my bitcoin safe on an exchange right now?

An exchange holds your private keys, so your bitcoin is only as safe as that company's security, reserves and insurance. The Binance incident shows the risk is real, but it does not establish that every platform faces the same failure. Check the specific protections of the platform you use.

Will Binance customers get their money back?

Binance says it will cover all losses from its SAFU fund and company funds, and says it has begun recovering affected assets. That is a company pledge, not independently confirmed reimbursement, and its October 30 update said recovery and verification were still ongoing.

Are Binance withdrawals open again?

CNBC reported a dated expectation to begin resuming withdrawal services within the next 48 hours, but that was not confirmation. Current service status has not been established here. Check official Binance channels and ignore unofficial links or messages.

Is self-custody the safest option?

Self-custody removes company counterparty risk but makes you responsible for key backup and recovery. It suits holders comfortable with that responsibility. It is not the right fit for everyone, and regulated custodians with disclosed insurance are a legitimate alternative.

What is the difference between a hot wallet and cold storage?

A hot wallet is an internet-connected cryptocurrency wallet. Cold storage means private keys are held offline, disconnected from the internet. Cold storage reduces online attack surface but does not remove every risk, such as physical loss or poor backup practices.

Read next

• compare bitcoin lending platforms and collateral terms