If your exchange gets hacked, what happens to your coins?

When coins sit on an exchange, they usually sit in the exchange's wallets, not in a wallet the holder alone controls. Digby dug into the October 29, 2026 Binance hot-wallet theft — with figures checked against Chainalysis, Elliptic and Binance's own updates as of November 9, 2026 (America/Los_Angeles) — to ask a practical question: if an exchange gets hacked, what happens to those coins, and why does the coin type matter?

How much was taken? Three estimates, side by side

The same incident is counted three ways. Digby keeps them labelled by source rather than picking a single "true" total:

The two freeze snapshots are about two and a half days apart. Elliptic's is from about 05:50 UTC on Nov 1 (about 1:50 a.m.² ET). Chainalysis's is from 11:30 a.m.¹ ET on Nov 3 (16:30 UTC). Elliptic's later laundering tracker, last updated Nov 9, 13:15 UTC, still put the frozen or seized total at $2.85B (Elliptic tracker).⁵

Those freeze totals are not the same as money already returned to customers. A freeze stops further transfers; returning funds is a separate step.

How fast did the attacker move?

Digby lined up the clocks the sources actually print:

1. Oct 29, ~4:20 p.m.¹ ET (about 20:20 UTC) — Chainalysis: funds begin leaving Binance hot wallets across multiple blockchains (Chainalysis). Elliptic and Binance put the first outflows a little earlier, at about 20:05 UTC (about 4:05 p.m.² ET), starting with XRP Ledger outflows, then Solana, NEAR, Base, Optimism, Bitcoin, Tron, Ethereum, Arbitrum and Avalanche within about 30 minutes (Elliptic). Binance's own Initial Findings also marks 20:05–20:09 UTC for the first XRP wave (@binance Initial Findings).³
2. Race to leave freezable coins — Chainalysis: over nearly 20 minutes, the attacker swapped $325M of stablecoins into $285M of ETH; freezes began by 5:14 p.m.¹ ET the same day (Chainalysis).
3. Who gets blamed — Elliptic: the FBI attributed the theft to North Korea's TraderTraitor group on Oct 31 (Elliptic had already assessed that as likely) (Elliptic). Chainalysis attributes the hack to TraderTraitor and says Binance funds later commingled on-chain with funds from the prior month's Bitget theft (Chainalysis).
4. Withdrawals pause, then reopen in phases — Binance suspended withdrawals after the incident, then said it was preparing to resume phase one on Nov 1, 2026, between 06:00 and 09:00 UTC (@binance Recovery Update #4; Elliptic noted Binance's Nov 1, 06:00 UTC announcement that withdrawals had begun reopening, starting with the Bitcoin network).⁶ As of Nov 9, 2026, Binance was still posting "Latest Withdrawal Update" lists of networks and assets re-enabled after security checks (for example @binance Nov 9, 04:56 UTC).⁷

What's freezable — and what isn't

Elliptic's plain rule of thumb matches what Digby saw in the freeze totals: tokens with an issuer can sometimes be frozen; native coins with no issuer freeze switch cannot.

Hot vs cold wallets (one line of context): the theft Digby is following hit hot wallets — online wallets used for day-to-day exchange flows. Cold (offline) storage is a different design choice; Digby is not ranking wallet products here.

What "we'll cover the losses" means here

Binance's company statements say customers will not bear the stolen amount:

• It will "absorb the financial impact of the stolen funds, not our users," and had "set aside more than 100% of the funds required to cover the loss" (Initial Findings, posted Nov 3, 2026) (@binance).³
• Its Oct 30 Recovery Update #2 said Binance would cover the stolen funds "through our Secure Asset Fund for Users (SAFU) and our corporate treasury," and had "set aside more than $6.34B in company funds, with $5B held in the exact impacted token assets that were stolen" (@binance Recovery Update #2).⁸
• Recovery Update #7 (posted Nov 4, 2026) says Binance had "replenished approximately 98% of the impacted amount" from its own resources and was still buying less-liquid tokens (@binance Recovery Update #7).⁹

Digby treats those as Binance's own claims. Chainalysis and Elliptic are tracing and freezing analysis firms; they do not audit Binance's SAFU balance, treasury or Proof of Reserves for Digby. Binance publishes a Proof of Reserves page so holders of listed tokens can run its verification tool — that is still a company process, not a Digby check.

A company promise to cover losses is not insurance and not a legal guarantee. In the U.S., the FDIC lists crypto assets among products it does not insure (FDIC).¹⁰ SIPC says it does not protect any digital or crypto asset that doesn't qualify as a "security" under the Securities Investor Protection Act (SIPC).¹¹

What Digby is still watching

• Whether freeze totals move after Elliptic's Nov 1 and Chainalysis's Nov 3 cutoffs.
• Which network–asset pairs remain closed on Binance's own withdrawal updates.
• How any recovered or unfrozen funds are described in later company or law-enforcement statements.

Related reading

• Onchain & stablecoins hub
• Markets & filings hub
• Credit union vs. bank (how federal deposit insurance covers bank and credit union deposits)

No credentials

The person behind DigbysMoney holds no financial credentials, so please check anything that matters to you with a qualified professional.

Any token, coin or airdrop that uses the DigbysMoney name or Digby's picture is not ours.