In about twenty minutes, around $6.3 billion in crypto left Binance wallets, and by the weekend millions of users could not take their own coins off the biggest exchange on earth. Bitcoin sat near $77,700, the Fear and Greed Index read 34, which means fear, and beginners asked one plain question: if the biggest exchange can get hit this hard, where is my money actually safe? This guide answers that question step by step.
In this guide:
- What actually happened at Binance
- What an exchange balance really means
- How to check if your exchange is safe
- The 7 steps that keep your crypto safe
- A worked example with $1,000
- Where to keep your crypto, compared
- Common mistakes after a big hack
- Frequently asked questions
- Quick summary
Key points:
- Binance says it has covered about 90% of the $6.3 billion taken, with withdrawals due back on November 1, but a promise to cover losses is not the same as coins in your own hands.
- Coins left on an exchange are a claim on that company, not coins in your pocket, because the exchange holds the keys.
- Keep only what you plan to trade on an exchange, a small amount in a hot wallet for daily use, and the rest where only you hold the keys.
What actually happened at Binance?
On October 29, crypto started leaving Binance hot wallets, which are the online wallets an exchange uses for day-to-day withdrawals. Hot means connected to the internet, so it is fast for users and, by the same token, open to attack. Binance later put the total hit at around $6.3 billion, the largest crypto theft on record, ahead of the $1.5 billion Bybit theft in February 2025. About $3 billion was frozen with help from partners, and the FBI blamed a North Korean state-linked group called TraderTraitor.
Binance said the attack was complex, starting from a compromised laptop, and that it found no proof that wallet private keys had leaked. A private key is the secret code that lets someone move coins from an address. The exchange paused withdrawals, then said it had covered about 90% of the stolen assets using its SAFU fund, which is an emergency fund set up in 2018 to protect users in extreme cases, part of its futures insurance fund, and its own company treasury. It took a fresh proof of reserves snapshot on October 31, said it would top the SAFU fund back up to about $1 billion, and aimed to reopen withdrawals on November 1.
Binance moved fast and put its own money in, which is why most users were told they would not carry the loss. But the basic risk stays: one company held billions in online wallets, and one attack reached them all at once.
What does an exchange balance really mean?
When you buy Bitcoin on an exchange and leave it there, the number on your screen is not a pile of coins with your name on it. It is a record in the company's own books that says the company owes you that much. The company holds the private keys, runs the wallets, and decides when withdrawals open or close. That is called custodial, which just means someone else holds it for you. The opposite is self-custody, where you hold your own keys.
This split is why the same hack hits people in different ways. If you held your coins in your own wallet, the Binance hack did not touch them at all, even while Bitcoin's price fell. If you held them on Binance, your coins were safe only because Binance promised to make users whole, while you waited for withdrawals to reopen. Only one group could move its money on Friday night. Exchanges are still useful for buying and selling, but do not treat one like a bank vault.
How do you check if your exchange is safe?
Start with proof of reserves, a phrase you will hear a lot this week. Proof of reserves is a public check that tries to show an exchange holds at least as much crypto as its users are owed, coin by coin. Binance took a new snapshot on October 31 and said users holding ten big coins, including Bitcoin, Ethereum, BNB, USDT, USDC, XRP and Solana, could check a backing ratio of at least 1 to 1 once the full proof was ready, expected by about November 3. That is a useful check, and far better than silence.
But read it the right way. Proof of reserves shows assets at one moment in time. It does not show everything the company owes, and it does not stop the next attack. Treat it as one green flag, not a guarantee. Also ask three plain questions: does the exchange say, in writing, that user funds are kept apart from company money? Does it name an emergency fund, and how big is it? Has it paused withdrawals before? If you cannot find clear answers, that silence is itself an answer.
What are the 7 steps that keep your crypto safe?
Step 1: Move what you are not trading off the exchange. Decide what you might sell this week, leave that part where you can trade it fast, and move the rest to a wallet where you hold the keys.
Step 2: Split what is left into three piles: trading money on the exchange, a small amount in a hot wallet on your phone, and long-term savings in a cold wallet, which keeps keys fully offline on a small hardware device. If one pile has a problem, the other two are untouched.
Step 3: Turn on app-based two-factor authentication, and switch off text-message codes if you can. Two-factor authentication means a second check, beyond your password, before anyone can log in or withdraw. An app makes a fresh code every 30 seconds. A text code can be stolen if someone tricks your phone company into moving your number to their SIM card, a trick called a SIM swap.
Step 4: Turn on withdrawal address whitelisting, and give new addresses a waiting period. Whitelisting means the exchange will only send coins to addresses you approved in advance, and a new address cannot be used at once. If someone gets into your account, they still cannot send your coins to their own wallet straight away.
Step 5: Check the address, the coin, and the network, every single time. Copy the address from your own wallet, paste it, then read the first four and last four characters back. Crypto transfers have no undo button, and a wrong network can mean a total loss.
Step 6: Write your recovery phrase on paper, keep it offline, and never type it anywhere else. A recovery phrase, also called a seed phrase, is a list of 12 or 24 ordinary words that can rebuild your whole wallet. No real support worker will ever ask for it. Anyone who asks is trying to steal from you, full stop.
Step 7: Use a separate email for crypto, and treat every urgent message as suspect. Scammers love hack weeks, because frightened users click fast. A fake support email or withdrawal link can empty a wallet in minutes. Go to the exchange by typing its address yourself, or by using its app, never through a link in a message.
Read also: What Is a Crypto Wallet? Hot Wallet vs Cold Wallet Explained
A worked example with $1,000
Suppose you hold $1,000 in crypto, and Bitcoin is near $77,700. Split it as this guide suggests: $100 stays on the exchange for trading, $200 goes to a hot wallet on your phone, and $700 goes to a cold wallet for the long term. That $700 is about 0.009 Bitcoin, because 700 divided by 77,700 is 0.009.
Now suppose the exchange pauses withdrawals for three days, as Binance did. Your $100 trading pile is stuck. Your $200 hot wallet pile is free to move at once, and your $700 cold pile was never at risk. Keep all $1,000 on the exchange instead, and every dollar is stuck. The split did not stop the hack. It stopped the hack from stopping you.
Where should you keep your crypto, compared?
| Where you keep it | Who holds the keys | Main risk | Best for |
|---|---|---|---|
| Exchange | The company | Hack, freeze, or company failure | Money you plan to trade soon |
| Hot wallet | You, on a phone or computer | Phishing, malware, or a lost phone | Small amounts for daily use |
| Cold wallet | You, on an offline device | Losing the device and the recovery phrase together | Savings you plan to hold for months |
My own read is this: most beginners overthink which wallet to buy and underthink the split. The split is the safety.
Common mistakes after a big hack
First, panic selling at the worst moment. Bitcoin fell hard on the hack news, then steadied near $77,700. Selling in the first hour of fear locks in the drop, and it does nothing to make your coins safer. Move your coins first, think about selling later, with a clear head.
Second, rushing a move and sending coins to the wrong place. After a hack, everyone wants their money out at once, and that hurry causes wrong addresses and wrong networks. Slow down for one minute per transfer, check the address twice, and send a small test first if the amount is large.
Third, trusting the first "help" that arrives. Fake support accounts flood social media after every big hack, offering to "verify" your wallet or "restore" your funds. Real exchanges never ask for your recovery phrase. If help arrives uninvited, treat it as an attack until proven otherwise.
Fourth, buying a hardware wallet from a random seller to save a few dollars. A device that passed through unknown hands could be tampered with before it reaches you. Buy direct from the maker, check the seal, and set it up yourself, with a fresh recovery phrase from the device.
Frequently asked questions
Is my money gone if my exchange gets hacked? Not always. In the Binance case, the company covered most of the loss from its own funds. But that depends on the company having the money and the will to pay, which is why you should never bet your whole stack on one promise.
Should I take everything off every exchange today? No. Keep what you actually trade on the exchange, so you can act fast. Move the rest, the part you would hate to lose, to a wallet where you hold the keys.
Does proof of reserves mean my coins are fully safe? No. It is a useful snapshot showing the exchange held enough of each coin at one moment. It does not prove the company owes nothing else, and it does not stop future attacks. Use it as one check, next to the split and the test move.
Quick summary
Binance lost about $6.3 billion, froze about $3 billion, covered about 90% from its own funds, and aimed to reopen withdrawals on November 1. The lesson is that any exchange holding your keys can freeze, get hit, or fail, so only trading money should live there. Split your holdings, use app codes, whitelist your addresses, test every move, and keep your recovery phrase on paper and offline. Do those seven steps once, and the next hack headline becomes news you read, not a crisis you live through.
Read also: What Is a Seed Phrase and How to Keep It Safe?
— BitByLine News Desk
I wrote this one to teach, not to push you toward any trade. BitByLine only explains and teaches — this is NOT financial advice, and we never tell anyone to buy or sell crypto. What you do with your money is your own call, and the risk sits with you too. Look into everything yourself first.
Read our full Disclaimer.
Sources: CoinDesk, Reuters, The National, Financial Express, Binance
Want the next guide in your inbox? Subscribe to the BitByLine newsletter.
Comments
Post a Comment
We love hearing from our readers! Share your thoughts, questions, or corrections below — please keep it respectful and on topic.