> ## Content Index > Fetch the complete content index at: https://theseguysknow.io/llms.txt > Use this file to discover other available public pages before exploring further. # Crypto Exchange Hacked? What to Do and Who Gets Repaid - URL: https://theseguysknow.io/crypto-exchange-hacked-what-to-do/ - Published: 2026-11-05T13:23:19.000Z - Updated: 2026-11-05T13:23:19.000Z - Description: After the record $6.3 billion Binance hack, here's what to do if your exchange is hit, which scams to ignore and how past hacks ended for customers. - Author: Larson Bryce - Tags: Scam Watch When an exchange you use gets hacked, the first few hours are confusing: withdrawals freeze, your feed fills with rumours and half of the "help" in your inbox is someone trying to rob you a second time. After Binance lost about $6.3 billion at the end of October 2026, the biggest crypto theft on record, we went through what happened, how past hacks turned out for customers and what you should do, so if your coins sit on an exchange, this is the calm, plain-English version. ## Quick Answer If your exchange gets hacked, don't panic-sell, don't click any "refund" or "compensation" link, and only trust the exchange's official app, website and verified accounts. Whether you get your money back depends mostly on how big the hole is compared with the exchange: large exchanges with reserves, like Binance and Bybit, have covered their customers in full, while smaller ones have left people waiting years and taking a loss. | Where Your Coins Are | What It Means for You | What to Do | | -------------------------------- | ----------------------------------------------------------------------- | ----------------------------------------------------------------------------------- | | On the hacked exchange | Withdrawals may pause, and repayment depends on the exchange's reserves | Wait for official updates, don't sell in a panic, ignore anyone offering "recovery" | | On a different exchange | Not directly affected, but scammers will target you anyway | Turn on a withdrawal allowlist and check your security settings | | In a wallet you control | Not affected by the hack | Keep your recovery phrase offline and never type it into a website | | In stablecoins like USDT or USDC | Stolen stablecoins can often be frozen by their issuers | Normal precautions, as your own balance isn't at risk | ## What Happened at Binance Late on Thursday, October 29, hackers drained about $6.3 billion from Binance's hot wallets, the online wallets the exchange uses for everyday withdrawals. The stolen funds spread across 10 blockchains and included about 18,270 bitcoin, 200,630 ether and more than $2.6 billion in the stablecoins USDT and USDC. Binance says the attack may have started with a compromised engineer's laptop and that it found no evidence its private keys leaked. The FBI has blamed TraderTraitor, a North Korean hacking unit it also linked to the roughly $1.5 billion Bybit theft in 2025, and blockchain analysts at TRM Labs, Chainalysis and Elliptic point to North Korea too. About $3 billion of the stolen money was frozen within days, mostly in USDT and USDC. Binance halted withdrawals, then reopened them in phases from November 1, starting with bitcoin, ether, USDT, USDC, BNB and XRP. It says it has already replaced about 95% of the stolen assets using its own funds, including its emergency fund for users, called SAFU, and that "these losses will not be passed on to users." The remaining 5% is smaller tokens that take longer to buy back. ## Hot Wallets and Cold Wallets, Explained Simply Think of an exchange like a shop with a till and a vault. The hot wallet is the till: it's connected to the internet so the exchange can pay out withdrawals quickly, which also makes it the part hackers go after. The cold wallet is the vault: it's kept offline, and most customer crypto is supposed to sit there. That's why a hack can be huge and still not sink an exchange. Binance lost billions from its till, but most of its customers' money was in the vault, and the business earns enough to refill the till itself. Co-CEO Yi He said this year's revenue alone would cover the loss. ## Why Some Stolen Crypto Can Be Frozen and Some Can't Stablecoins like USDT and USDC are issued by companies, Tether and Circle, and those companies can block their tokens at a specific address so they can't be moved or spent. That's how about $3 billion of the Binance haul was frozen so quickly, although frozen isn't the same as returned, and getting it back can take months. Bitcoin, ether and most other coins have no company behind them that can press a freeze button. Once hackers have them, they usually run them through mixers and swaps to hide the trail, which is why money stolen in those coins rarely comes back. ## Did Customers Get Their Money Back? This is the question everyone asks first, so we looked at how the biggest exchange hacks and collapses turned out for the people with money on them. | Exchange | Year | What Was Lost | What Customers Got | | --------- | ---- | -------------------------------------------- | ----------------------------------------------------------------------------------------------- | | Mt. Gox | 2014 | About 850,000 bitcoin went missing | Repayments only started a decade later, and the deadline is now October 2027 | | Coincheck | 2018 | About $530 million in NEM | Refunded in yen within about two months | | Binance | 2019 | 7,000 bitcoin, about $40 million | Covered in full by its SAFU emergency fund | | WazirX | 2024 | About $230 million, around 45% of user funds | 85.5% back after a Singapore court approved a plan in October 2025, the rest in recovery tokens | | Bybit | 2025 | About $1.5 billion in ether | Covered in full, and withdrawals kept running | | Binance | 2026 | About $6.3 billion | 95% replaced within days, with Binance absorbing the loss | The pattern is fairly clear once you line them up. What decides the outcome is how big the hole is compared with the exchange itself: a big exchange with reserves and steady revenue can swallow even a record loss, while a hack that wipes out a large share of all customer money, like WazirX's 45%, ends in courts, haircuts and long waits. The size of the headline number tells you much less than the size of the exchange behind it. ## What to Do in the First Hour, Day and Week ### The First Hour Don't sell in a panic, because prices often dip on the news and recover once the exchange explains how it will cover the loss. Don't click links in emails, texts or DMs about refunds, and don't reply to anyone who messages you first claiming to be support, as real exchange staff never ask for your password, two-factor codes or recovery phrase. ### The First Day Follow the exchange's official channels only: its app, its website typed in by hand, and its verified accounts. Change your exchange password and email password if you reuse them anywhere, turn on app-based two-factor authentication instead of SMS, and switch on a withdrawal allowlist (some exchanges call it a whitelist) so money can only go to addresses you've already approved. ### The First Week Once withdrawals reopen and the dust settles, decide calmly where your coins should live, rather than rushing everything out on the first day along with everyone else. Binance saw about $2.5 billion leave on the day it reopened, and pulling money out in a crowd raises your chances of a rushed mistake, like pasting the wrong address. ## The Scams That Follow Every Big Hack The second wave of every big hack is scams, and it often costs ordinary people more than the hack itself. The most common ones look like this: - **Fake compensation portals:** sites that copy the exchange's design and ask you to "connect your wallet" or "verify your account" to claim a refund. - **Fake support:** accounts on X, Telegram or Discord that reply to your complaint and move you to a private chat. - **Recovery services:** people or "firms" promising to trace and return stolen crypto for an upfront fee. - **Address poisoning:** scammers send you a tiny transaction from an address that looks almost exactly like one you've used, hoping you'll copy it from your history next time. A simple rule covers almost all of them: if a refund needs you to pay something, connect a wallet or share your recovery phrase, it's a scam. Genuine reimbursements show up in your exchange account without you doing anything. ## Should You Move Your Crypto Off the Exchange? Crypto fans will tell you "not your keys, not your coins," and there's truth in it, since coins in a wallet you control can't be frozen, hacked from an exchange or lost in someone else's bankruptcy. The catch is that you become the bank, so if you lose your recovery phrase or get tricked into typing it into a fake site, nobody can give your money back. For most people a sensible middle ground works: keep what you trade on a large, established exchange with its security settings switched on, and move long-term holdings to a hardware wallet once you're comfortable looking after a recovery phrase. If you're not sure you could keep a phrase safe for years, a big exchange with a track record of covering losses may honestly be the safer place for now. ## How to Check an Exchange Before You Trust It Look for regular proof-of-reserves reports, which show that the exchange holds at least as much crypto as its customers have deposited, and check when the last one was published. Look at its history too: has it been hacked before, and did customers get paid back? The table above is a good place to start. Our guide on [how to tell if a crypto platform is legit](https://theseguysknow.io/how-to-spot-a-shady-crypto-platform/) covers the other warning signs, from fake licences to withdrawal limits that suddenly appear. ## Our Take The Binance hack is a record, but for most of its customers it's turning out to be a stressful week rather than a financial loss, because the exchange is big enough to pay for its own mistake. That won't be true everywhere, and the history shows the real danger sits with smaller platforms, where one bad night can freeze people's savings for years. The best thing you can do today is ignore everyone promising to help, switch on the security settings you've been putting off, and decide where your coins should live while you're calm. When this hack hit stock markets the same week, we covered the bigger picture in [why the stock market is down](https://theseguysknow.io/why-is-the-stock-market-down/). ## FAQ ### Will Binance Pay Back Customers After the Hack? Binance says it will absorb the losses and that they won't be passed on to users. It had replaced about 95% of the stolen assets by November 1, using its own funds and its SAFU emergency fund. ### Can Stolen Crypto Be Recovered? Sometimes. Stablecoins like USDT and USDC can be frozen by their issuers, which is how about $3 billion of the Binance theft was locked, but bitcoin and ether usually can't be frozen, and stolen coins often disappear through mixers. ### Is My Crypto Safe on an Exchange? It depends on the exchange. Large exchanges with reserves have covered recent hacks in full, while smaller ones have left customers with losses and long waits, so check proof-of-reserves reports and the exchange's track record. ### What Is a Hot Wallet? A hot wallet is a crypto wallet connected to the internet. Exchanges use them to pay out withdrawals quickly, which makes them the main target for hackers, while most funds are meant to sit offline in cold wallets. ### Someone Offered to Recover My Stolen Crypto. Is It Real? Almost certainly not. Recovery services that ask for an upfront fee are one of the most common scams after a hack, and real reimbursements arrive in your exchange account without you paying anything. ### Should I Sell My Crypto After an Exchange Hack? That depends on your own situation, and it's a decision for you or a licensed adviser. Selling in a panic is rarely a good idea, though, because prices often dip on the news and the exchange's response usually matters more than the hack itself. #### Sources - [CoinDesk: Binance opens withdrawals in phases after the $6.3 billion hack](https://www.coindesk.com/markets/2026/11/01/binance-opens-crypto-withdrawals-in-phases-starting-with-bitcoin-following-usd6-3-billion-hack?ref=theseguysknow.io) - [Insurance Journal: Binance restarts withdrawals as questions linger](https://www.insurancejournal.com/news/international/2026/11/01/891003.htm?ref=theseguysknow.io) - [CNBC: Bybit says it fully replenished reserves after $1.5 billion hack](https://www.nbcsandiego.com/news/business/money-report/crypto-exchange-bybit-says-it-fully-replenished-reserves-after-record-1-5-billion-hack/3762071/?ref=theseguysknow.io) - [MediaNama: Singapore court approves WazirX's amended repayment plan](https://www.medianama.com/2025/10/223-wazirx-singapore-hc-amended-debt-repayment-plan/?ref=theseguysknow.io) - [Decrypt: Mt. Gox pushes its repayment deadline to 2027](https://decrypt.co/381392/mt-gox-pushes-repayment-deadline-to-2027-with-2-8b-in-bitcoin-still-to-distribute?ref=theseguysknow.io) - [CNBC: Hacked Japanese exchange Coincheck to repay owners](https://www.cnbc.com/2018/01/27/hacked-japanese-cryptocurrency-exchange-to-repay-owners-425-million.html?ref=theseguysknow.io) - [Bloomberg: Binance reports a hack of 7,000 bitcoin](https://www.bloomberg.com/news/articles/2019-05-08/crypto-exchange-giant-binance-reports-a-hack-of-7-000-bitcoin?ref=theseguysknow.io) ****TGK** - [How to Tell if a Crypto Platform Is Legit](https://theseguysknow.io/how-to-spot-a-shady-crypto-platform/) - [Why Is the Stock Market Down?](https://theseguysknow.io/why-is-the-stock-market-down/)