Where to Keep Crypto in 2026: Exchange or Wallet After the Binance Hack

Short answer: for an active trader, keep on the exchange only the margin for open positions, a buffer against moves, and the coins you plan to trade soon. Keep everything else in a wallet you control, ideally a hardware wallet bought directly from its maker. Neither place is risk-free, but the risks are different. When a large exchange was hacked, users were made whole and waited from zero to 18 days. When an exchange went bankrupt, the first payout took 11 to 27 months, and some customers got nothing. Self-custody moves the risk to you: in 2025, thieves took $713 million from personal wallets in 158,000 incidents, and in October 2026 Ledger confirmed hardware wallets with hidden implants sold by a reseller.

This guide is for spot and futures traders asking the same question after the Binance hack of October 29, 2026. It includes our own table of 15 exchange failures since 2022 and what each one meant for the people with money inside. It does not rank exchanges or wallet makers.

Facts as of November 4, 2026. Not investment advice.

Where is the safest place to keep crypto in 2026?

There is no single safest place, because each option fails in its own way. The table shows what each one protects against and what went wrong with it in 2025 and 2026.

What decides where your coins should sit is how fast you need them. A futures trader needs margin on the exchange within minutes. A long-term holder can wait days for a transfer. The rest of this guide shows what each risk looked like in practice.

What happened to users' money after exchange hacks and bankruptcies?

We collected 33 cases of hacked, frozen or bankrupt exchanges and crypto lenders from 2022 to November 4, 2026, and charted 15 with known outcomes. The pattern is clear: a hack at a large exchange cost users time; a bankruptcy cost them money.

When an exchange is hacked and stays solvent, it pays users from its own funds and reopens withdrawals. Bybit lost about $1.5 billion in February 2025 and never stopped withdrawals: it processed more than 350,000 requests in the first 10 hours and restored full backing within 72 hours with loans and purchases (Bybit). Binance lost about $6.4 billion on October 29, 2026 and reopened withdrawals about two and a half days later. Bitget lost $387.5 million in September 2026 and reopened bitcoin withdrawals after about four days and all assets after about eight (Reuters). In each case balances stayed whole.

When a smaller exchange is hacked, the loss can land on users. WazirX in India lost $234.9 million in July 2024, kept withdrawals frozen for about 15 months and returned about 85% of balances plus recovery tokens through a court-approved scheme in Singapore (Outlook Money). DMM Bitcoin in Japan covered its 4,502.9 BTC loss in full, but restrictions lasted until accounts moved to another exchange nine months later. Lykke stopped trading after a $22.4 million hack and went bankrupt.

When an exchange goes bankrupt, you wait years and get paid in dollars at the price on the day of the collapse. FTX made its first payout 27 months after it stopped withdrawals. It paid 105% of claims, but claims were fixed at November 2022 prices, when bitcoin traded near $16,871. At today's price that is about 22% of the bitcoin a customer held (our calculation). Celsius has paid 64.9% so far and Voyager about 70%. Customers of AAX and of JPEX in Hong Kong have received nothing.

Two newer cases are still open: Brazil's Mercado Bitcoin was hacked for $40 to $49 million on November 2, 2026 and has promised to cover users, and AscendEX shut down in July 2026 without guaranteeing withdrawals.

The lesson for a trader is not "exchanges are safe" or "exchanges are unsafe". It is that the size and solvency of the exchange decide whether a bad day costs you a week of access or most of your balance. An exchange can also leave a country with a few days' notice, which we covered in our analysis of the Bitget and MEXC exits.

Is it safe to keep crypto on Binance after the hack?

Here are the facts; the decision depends on how much you keep there and why. On October 29, 2026, attackers linked to North Korea took about $6.3 to $6.4 billion from Binance hot wallets after compromising an engineer's laptop. Binance said user balances would not be reduced. By October 31 it had replenished 90% of the stolen assets from its SAFU fund (converted to 15,000 BTC earlier in 2026), part of its futures insurance fund and its own treasury (Reuters), and by November 2 it reported 95%. Withdrawals reopened on November 1 at 06:00 UTC, with more networks added from November 3. On November 2 it published an emergency proof-of-reserves snapshot claiming at least 100% for 10 assets (The Block).

Two details matter for futures traders. First, part of the futures insurance fund went to cover the hack; that fund is the buffer that absorbs bankrupt positions before an exchange starts auto-deleveraging profitable traders. Second, about $1.55 billion of positions were liquidated across the market in the 24 hours after the hack (The Block), and for the next two and a half days anyone who wanted to move collateral from Binance to another exchange could not.

We explain what happened in our report on the hack and where the stolen money went in our follow-up.

How often are crypto exchanges hacked?

Rarely, but when they are, the sums are enormous. In DefiLlama's database of hacks and exploits, centralized exchanges made up 1.5% of incidents in 2026 so far but 77.7% of the value stolen. In 2025 they were 8.1% of incidents and 69.6% of the value.

Personal wallets show the opposite pattern: many small thefts. Chainalysis counted 158,000 personal-wallet compromises in 2025 with at least 80,000 victims and $713 million stolen, about 20% of all crypto stolen that year (The Block). DefiLlama does not include those cases, so the two sources can't be added together.

Most large exchange hacks of 2024 to 2026 hit hot wallets or the systems that sign transactions, not cold storage. North Korean groups were behind about 89% of reported hack losses in 2026, according to Chainalysis (crypto.news).

Can a hardware wallet be hacked?

The chip inside is hard to break. In 2025–2026 attackers went around it instead: they tampered with the device before it reached the buyer, tricked owners into approving transactions they couldn't read, or simply asked for the seed phrase.

• Tampered devices. On October 10, 2026, Ledger confirmed that a device sold by CryptoBilis, a reseller based in Malaysia, contained a hidden implant. Researchers found an extra board with an LTE modem and an eSIM that read the screen and buttons during setup, worked out the recovery phrase and sent it to the attackers. Ledger's Genuine Check cannot detect such an implant if the original secure chip is intact (BleepingComputer). Ledger asked resellers in seven Asian markets to stop sales, and Singapore police linked about S$3.5 million in losses to tampered devices bought from local shops. On October 30 Trezor warned about a reported implant in a Safe 5 sold by the same reseller, which it had not yet examined (Trezor).
• Blind signing. In the Bybit hack, signers approved a $1.5 billion transfer on hardware wallets because a compromised web page showed them a harmless transaction (The Hacker News). A hardware wallet signs what you approve; it can't tell you that the screen on your computer lied.
• Phishing for the seed. In 2025, fake Ledger Live apps on macOS asked for the recovery phrase after a fake "critical error", and paper letters posing as Ledger asked owners to type their 24 words into a website (The Block).
• Physical threats. Jameson Lopp's public list of physical attacks on crypto holders has 168 entries for 2025 and 144 for 2026 up to October 24 (our count). Chainalysis counted 46 violent attacks in the first half of 2026 with more than $30 million taken (Decrypt).

What protects you: buy only from the manufacturer's website or a reseller listed there, never second-hand or at a discount. Generate a new recovery phrase yourself and never use one that came with the device. Check every address and amount on the device's own screen. And don't tell people how much crypto you hold.

How do hot wallets get drained?

Mostly by the owner approving something. Scam Sniffer counted $83.85 million lost by 106,106 victims to signature phishing in 2025, with an average loss of $790 (Scam Sniffer). The largest single losses came from tricks that needed no hacking at all:

• Address poisoning. In December 2025 a trader sent about $50 million in USDT to a lookalike address copied from their own transaction history, where attackers had planted it with a tiny transfer (The Block).
• Malicious updates. Version 2.68.0 of the Trust Wallet browser extension, released on December 24, 2025, sent wallet data to attackers; at least $7 million was stolen before a fix (BleepingComputer).
• "Upgrade your account" signatures. Since Ethereum's 2025 upgrade, one signature can hand control of a wallet to another contract. Wintermute found that more than 80% of such delegations pointed to copy-pasted contracts that sweep wallets automatically (The Block). The same mechanism was used against Binance's hot wallet in October 2026.

A hot wallet is fine for small amounts you use in apps. It is the wrong place for savings.

I trade futures: how much should I keep on the exchange?

Keep the margin your open positions need, a buffer against adverse moves, and the coins you plan to trade soon. We found no regulator or independent researcher who gives a percentage; the "90% cold, 10% hot" splits online come from custody companies' marketing. What decides your number is how quickly you'd need to add margin and whether you could, if transfers were slow or the exchange froze.

Three facts help set that number:

• Deposits take time. An exchange credits a deposit after its own number of network confirmations, which differs by coin and is listed on its deposit page.
• Exchange freezes block both directions. During the Binance pause you could not move collateral out to another venue, and some exchanges briefly paused deposits too.
• Your own security locks slow only withdrawals. A new-address lock or withdrawal delay never stops you from adding margin, so turning them on doesn't hurt your trading.

Withdrawing profits regularly keeps the balance at risk close to what you actually trade. Keeping funds on two exchanges limits the damage if one freezes. Prop trading changes the picture: on a funded account at a firm such as Binam, you trade the firm's capital, so your own coins don't need to sit on an exchange as margin.

Does a withdrawal whitelist protect you if the exchange is hacked?

No. Exchange security settings protect your account, not the exchange's wallets. It helps to separate three levels of risk:

1. Your account: someone logs in as you. A whitelist, a new-address lock, a passkey and an anti-phishing code all work here.
2. The platform: the exchange itself is hacked or goes bankrupt. Nothing in your settings helps; only the amount you keep there does.
3. Your device: malware or a tampered wallet. Only self-custody hygiene helps: buying direct, checking addresses, reading signatures.

One detail surprises many traders: on Bybit, and on Binance with one-step withdrawal turned on, whitelisted addresses get less verification, not more. That makes the whitelist only as strong as your login, so pair it with a daily limit and a new-address lock.

How to lock down your exchange account

The four largest exchanges offer the same tools under different names. Check the exact menu in your app, since names change between versions and regions.

Sources: Binance, Bybit, OKX, Bitget.

A minimum setup for a trader: a passkey or hardware key instead of SMS codes, an anti-phishing code, a whitelist with a new-address lock, and trading API keys with no withdrawal right and an IP whitelist. If you connect bots or AI tools, our guide to AI trading tools covers key permissions in detail. Avoid changing security settings during a volatile market: the automatic 24–48 hour freeze afterwards can't be lifted early.

What proof of reserves shows and what it doesn't

Binance, OKX, Bybit and Bitget all publish monthly proof of reserves, and all four show at least 100% for major coins. Bitget's report from after its September 2026 hack shows 142% for BTC, 110% for ETH and 107% for USDT (Bitget). Bybit's September report shows 104% for BTC (Crypto Briefing).

A proof of reserves shows that the coins customers deposited existed on-chain at the moment of the snapshot. It does not show:

• that the exchange has no other debts;
• that the list of customer balances is complete (each user can check only their own entry);
• that the keys are safe. Binance and Bitget were both above 100% shortly before their 2026 hacks.

The accounting firm Mazars stopped preparing these reports for crypto exchanges in December 2022, citing concerns about how the public understood them (Accounting Today). Read a proof of reserves as a monthly check that the coins are there, not as an audit.

How to move crypto from an exchange to your own wallet safely

1. Buy the hardware wallet from the maker's website or a listed reseller.
2. Set it up yourself and write down a new recovery phrase offline. Never type it into a computer or phone.
3. Get the receiving address from the device and check it on the device's screen.
4. On the exchange, add that address to your whitelist. Choose the right network: the address format alone doesn't stop you from sending on the wrong one.
5. Send a small test amount first, then the rest.
6. Never copy an address from your transaction history; that is how address poisoning works.

Where should you keep USDT and other stablecoins?

The same rules apply, with one difference: the issuer can freeze tokens. After the Binance hack, Tether froze the attackers' main USDT wallet within 37 minutes and Circle froze 823 million USDC before it could be swapped (our report). That power protects victims, but it also applies to any address the issuer flags, including one that received funds from a flagged address. Check where your stablecoins came from before sending them on, and keep track of which network they are on, since fees and freeze rules differ.

Frequently asked questions

Is it safe to keep crypto on an exchange?

It is reasonable for money you trade, and risky for savings. In 2022–2026, large exchanges that were hacked covered users within days, while bankrupt exchanges took 11 to 27 months to make a first payout, and some paid nothing.

Is Binance still safe after the hack?

Binance says user balances were not reduced, 95% of the stolen assets were replenished by November 2, 2026, and withdrawals reopened on November 1. Its reserves were above 100% before the hack too, which is why proof of reserves alone doesn't answer the question.

Can a cold wallet be hacked?

The secure chip is rarely broken. Losses come from tampered devices bought from resellers, approving transactions you didn't read, and giving the recovery phrase to a fake app or letter. In October 2026 Ledger confirmed implants in devices sold by the reseller CryptoBilis.

What happens to my crypto if an exchange is hacked?

If the exchange stays solvent, it usually covers the loss and you wait from hours to a few weeks to withdraw. If it can't cover the loss, you may get part of your balance after months or years, as with WazirX (about 85% after 15 months).

How much crypto should I keep on an exchange?

No regulator or researcher gives a percentage. For a futures trader the floor is the margin for open positions plus a buffer; the rest can sit in self-custody.

Where should I store my seed phrase?

Offline, on paper or metal, in a place only you can reach. Never in a photo, a cloud note, an email or a chat. No real support team will ever ask for it.

How we built the data

We collected exchange hacks, freezes and bankruptcies from 2022 to November 4, 2026 from exchange statements, court filings and the DefiLlama and SlowMist databases, and checked each against news reports from Reuters, The Block, CoinDesk and others. For hacks we measured the time until crypto withdrawals reopened for all users; for bankruptcies, the time until the first distribution. The FTX figure in bitcoin terms is our calculation from the claim price of $16,871 per BTC. The share of exchange hacks is our calculation from DefiLlama's hacks database, downloaded on November 4, 2026. Lopp's list counts are ours from the public list on that date. We do not rate exchanges or wallet makers.

Where to start

Turn on the protections in the table above today; they take ten minutes. Before you size your next position, check how close your liquidation price really is. Binam is a crypto prop trading firm: you trade crypto futures with the firm's capital after passing a challenge, so your own savings don't have to sit on an exchange as margin.

Trading crypto involves risk. This article is for information only and is not investment advice.