Exchange hacked.What happens to your tokens?
On 29 October 2026 attackers drained about $6.3 billion from Binance’s hot wallets — the largest crypto theft on record. Binance says it will cover all losses. Whether a hack like this touches you depends on one thing: where your token sits when it happens. Below: the three places a token can be, nine past exchange hacks and who paid for them, and what a cold wallet protects against.
Reviewed October 30, 2026 · figures from our live data
The short answer
Tokens you hold on an exchange are a claim against that exchange. If it is hacked, you depend on the exchange covering the loss — there is no legal right to that and no deposit insurance.
Tokens in your own wallet are not touched by an exchange hack. Your risk moves to your own key, the token’s smart contract and the issuer.
For tokenized funds, bonds and T-bills the real asset sits with the issuer’s custodian, not on the exchange. A hack steals tokens, not the fund behind them — and many issuers can freeze stolen tokens and reissue them.
History is mixed: large exchanges have usually repaid in full from their own money, smaller ones paid part or went bankrupt. Mt. Gox customers waited ten years.
tokenized T-bills and bonds, backed by assets at a custodian in our data today
issuers
stated yield range across 68 with a rate
Where your token sits decides what a hack means
The same token can sit in three different places. Each one has its own risk.
- 1
On the exchange
The exchange holds the keys; your balance is an entry in its books. If its wallets are drained, your balance is only as good as the exchange’s will and ability to refill them. Withdrawals are usually paused for days while it checks its systems.
- 2
In your own wallet
You hold the key, so an exchange hack does not reach your tokens. In exchange you carry the key risk yourself: a lost recovery phrase or a phishing signature cannot be reversed by anyone.
- 3
With the issuer’s custodian
Tokenized funds, bonds and T-bills are backed by assets at a bank, broker or trust. An exchange hack can steal the tokens but not the assets behind them. Many regulated tokens can be frozen and reissued by the issuer, so stolen units can sometimes be blocked and replaced.
Nine exchange hacks and who paid
Amounts at the time of the hack. Large exchanges with deep reserves usually covered losses from their own money; smaller ones shared the loss with customers.
- 1
Binance, Oct 2026 — about $6.3 billion
Hot wallets on about ten blockchains drained; preliminary cause a compromised engineer’s laptop. About $3 billion frozen with blockchain partners. Binance has pledged to cover all losses from its SAFU fund and company funds; withdrawals paused (status 30 Oct 2026: pledged, not yet completed).
- 2
Bybit, Feb 2025 — about $1.5 billion
Ether taken from a multisig cold wallet after the signing interface was manipulated. Bybit restored 1:1 reserves within about 72 hours with loans and purchases; customers did not lose funds.
- 3
WazirX, Jul 2024 — about $235 million
Multisig wallet drained. Accounts frozen for over a year; a court-approved restructuring returns roughly 75–80% of balances, the rest as recovery tokens.
- 4
DMM Bitcoin, May 2024 — about $305 million
About 4,500 BTC stolen. The DMM Group promised to cover the full amount from group funds; the exchange later wound down and moved customer accounts to another exchange.
- 5
KuCoin, Sep 2020 — about $280 million
Hot wallets drained. KuCoin said its insurance fund would cover the losses, and much of the stolen amount was later recovered or frozen.
- 6
Binance, May 2019 — about $40 million
7,000 BTC taken from a hot wallet. Covered in full by Binance’s SAFU fund, which was set up for exactly this case.
- 7
Coincheck, Jan 2018 — about $530 million
NEM tokens stolen from a hot wallet. Coincheck refunded about 46.6 billion yen to 260,000 customers from its own funds.
- 8
Bitfinex, Aug 2016 — about $70 million
About 120,000 BTC stolen. All customers took a 36% haircut and received BFX tokens for the loss; Bitfinex bought them back in full within eight months.
- 9
Mt. Gox, Feb 2014 — about 850,000 BTC
The exchange went bankrupt. Creditors received partial repayments only from 2024, ten years later.
What a cold wallet protects against — and what not
A cold wallet keeps the key offline. That closes one door, not all of them.
- 1
Protects: exchange hacks and insolvency
Tokens you withdraw to your own cold wallet are out of reach of an exchange’s attackers, frozen withdrawals and bankruptcy courts.
- 2
Protects: online malware
The key never touches an internet-connected device, so a compromised laptop cannot copy it.
- 3
Does not protect: what you sign
The Bybit and WazirX losses came from wallets with offline keys: the signers approved a transaction that looked different from what it did. Check the address and amount on the device screen, not only in the browser.
- 4
Does not protect: the token itself
A smart-contract bug, a stablecoin losing its peg or an issuer failing hits your tokens wherever they are stored.
- 5
Does not protect: a lost recovery phrase
Write it down, keep it offline, never type it into a website or a chat. Nobody can restore it for you.
- 6
A practical split
Keep on the exchange only what you trade. Move what you hold to your own wallet, and for larger amounts use a multisig so no single device can move everything.
The 12 highest stated yields
Yields as stated by the issuer or read on chain, with the date they were checked on each token page. Not a recommendation.
| Token | Issuer | Yield | Minimum |
|---|---|---|---|
| Lcl Opportunities 3 S.a R.l. 10.5% 2030 (digital bond) | Lcl Opportunities 3 S.a R.l. | 10.5% coupon | — |
| PKH Mining Note 2 | Not named by STOKR | 10% revenue share | US$ 115,000; token price US$ 1.00 |
| UTIISIB UAB Riverside real estate fund bond 2029 | UTIISIB UAB Riverside real estate fund | 9.5% coupon | — |
| LHM Holding UAB bond | LHM Holding UAB | 9% coupon | — |
| UAB Verslo parko projektai bond 2028 | UAB Verslo parko projektai | 9% coupon | — |
| NSP3, UAB bond 2028 | NSP3, UAB | 8% coupon | — |
| UAB NordSpace Projektai bond 2027 | UAB NordSpace Projektai | 8% coupon | — |
| Larsen & Toubro 7.40% tokenised NCDs 2029 (India's first private-sector tokenised bond) | Larsen & Toubro Limited | 7.40% | ₹1 lakh |
| REC 7.30% tokenized corporate bond (India's first, SEBI sandbox pilot) | REC Limited | 7.30% | — |
| UAB Gesons bond 2028 | UAB Gesons | 6.5–9.5% coupon | — |
| Securitize Tokenized AAA CLO Fund | Securitize Capital (BNY partnership per press title) | 30-Day Yield 4.65% as of 10/1/26 | $100,000 |
| WisdomTree Short-Duration Income Digital Fund | WisdomTree Prime | SEC 30 Day Yield 4.42%, Distribution Yield 4.65%, Yield to Maturity 5.01% (as of 06/30/2026) | — |
Questions
Will Binance repay customers after the October 2026 hack?+
Binance has said it will cover all losses from its SAFU fund and company funds and that user funds are safe. As of 30 October 2026 this is a pledge; withdrawals were paused while it rebuilt its withdrawal service.
Do exchanges have to repay hacked customers?+
Generally no. Repayment is a business decision, not a legal guarantee, and crypto balances are not covered by deposit insurance. Exchanges that went bankrupt, like Mt. Gox, repaid only partly and years later.
Is my tokenized fund or T-bill token lost if the exchange is hacked?+
The assets behind it stay with the issuer’s custodian. Tokens stolen from the exchange are gone from your account, but many regulated issuers can freeze stolen tokens and reissue them, which improves the chance of recovery.
Is a cold wallet safe from hacks?+
It is safe from exchange hacks and from malware copying your key. It does not protect you from signing a harmful transaction, from a flaw in the token’s contract or from losing your recovery phrase.
What is the SAFU fund?+
The Secure Asset Fund for Users is a reserve Binance set up in 2018 to cover user losses in extreme cases. It paid for the 2019 hack. It is Binance’s own fund, not an insurance with a legal claim.
- What happens if a token issuer fails →
- RWA risks explained →
- How to verify a token contract →
- Guide for investment agents →
- CoinDesk — Binance loses over $6 billion (29 Oct 2026)
- NBC News — Binance targeted in $6.3 billion heist
- Help Net Security — Binance theft (30 Oct 2026)
- CNBC — Bybit fully replenished reserves
- Decrypt — WazirX resumes after $234M hack
- Cointelegraph — WazirX court approval
- CryptoPotato — DMM Bitcoin hacked
- TechCrunch — Binance 2019 hack
- SecurityWeek — Coincheck refunds customers
- Wikipedia — Mt. Gox
This guide explains how these products work and is not investment advice or an offer of any security. Who may buy a product is set by its issuer; check the offering documents before investing.