The Binance hack has brought one of cryptocurrency’s biggest security questions back into the spotlight: hot wallet vs. cold wallet—which is safer, and how do crypto exchanges protect customer funds?
On October 29, 2026, Binance reported a major security incident involving unauthorized withdrawals from its hot wallets. The exchange subsequently estimated the loss at approximately $6.3 billion in digital assets.
The incident quickly became an industry-wide concern. Reuters reported that other major exchanges, including Coinbase and Kraken, were reviewing security measures. Coinbase made precautionary adjustments to systems used for offline cryptocurrency key storage.
That does not mean Coinbase or Kraken experienced a related hack. It means a major incident at one exchange prompted others to reassess their defenses.
For beginners, the story raises an important question: If cryptocurrency exchanges use cold storage, how can billions of dollars still be exposed to hackers?
The answer involves much more than the difference between hot and cold wallets.
It involves private keys, transaction approvals, exchange infrastructure, operational controls, customer custody, and emergency response systems.
This guide explains those layers in simple terms, using the Binance incident as a real-world example without assuming that every detail of the attack has already been established.
A hot wallet operates in an internet-connected environment and helps exchanges process cryptocurrency transactions efficiently.
A cold wallet keeps private keys offline or isolated from internet-connected systems, reducing exposure to certain remote attacks.
Most importantly: Cold storage does not automatically make an exchange safe. Security also depends on who can authorize transactions, how systems are monitored, and how the exchange responds when something goes wrong.
Binance Hack Update: Why Exchange Wallet Security Is Under Scrutiny
Binance confirmed that its hot wallets were compromised at approximately 20:05 UTC on October 29.
The exchange reported approximately $6.3 billion in stolen token assets and said it would cover the financial impact using corporate resources and its Secure Asset Fund for Users (SAFU).
Binance also reported:
- More than $6.34 billion in company resources had been set aside to address the losses.
- Approximately $3 billion in affected assets had been frozen on-chain.
- Withdrawals were temporarily suspended while security reviews continued.
- Investigators identified additional breach points beyond an initially suspected compromised laptop.
- The company had found no evidence of leaked wallet private keys at that stage.
Binance said its investigation was ongoing and that it intended to publish further technical findings and updated Proof of Reserves information.
Primary source: Binance Security Incident Update #2 .
These figures and commitments are based on Binance’s published statements. They should not be confused with independently completed reimbursement, a final forensic investigation, or a full financial audit.
Likewise, cryptocurrency that has been frozen is not necessarily cryptocurrency that has already been recovered.
For the incident timeline and ongoing developments, see CoinFulcrum’s Binance security incident coverage .
Here, our focus is different: how exchange wallet systems are designed, where their risks come from, and what users can learn from the incident.
How Do Crypto Exchanges Store Customer Cryptocurrency?
When someone deposits Bitcoin or Ethereum into a centralized exchange, the platform typically takes responsibility for managing the private keys associated with the deposited assets.
The customer’s account then displays a balance recorded in the exchange’s internal systems.
That balance represents a claim against assets managed by the platform, rather than a separate self-custody wallet controlled directly by the customer.
The exchange must manage several activities:
- Receiving customer deposits.
- Recording account balances.
- Processing approved withdrawals.
- Managing cryptocurrency liquidity.
- Protecting private keys and transaction systems.
- Maintaining records of assets and customer liabilities.
To perform these functions, exchanges may use a combination of hot wallets, cold storage, and other specialized custody arrangements.
The exact architecture varies between platforms and is not always publicly disclosed.
A Simplified Exchange Storage Model
Illustrative model only. It does not represent the confirmed internal architecture of Binance, Coinbase, Kraken, or another specific exchange.
An exchange can use sophisticated cold storage while still depending on online systems to process customer withdrawals.
Those online systems are one reason exchange security requires multiple layers of protection.
Why Do Exchanges Need Hot Wallets?
Imagine an exchange with customers requesting withdrawals throughout the day.
Some users want to transfer Bitcoin to another wallet. Others want to send Ethereum to a supported address.
If every transaction required a lengthy offline approval process, withdrawals could become slow and difficult to manage.
Hot wallets help solve this operational problem.
Built for operational access
An exchange hot wallet operates within an internet-connected transaction environment.
Its purpose may include processing authorized withdrawals, receiving assets, or supporting other operational blockchain activity.
Main advantage: Convenient transaction processing.
Main trade-off: Greater exposure to online systems and their security weaknesses.
The risks are not limited to someone stealing a private key.
An attacker might attempt to compromise the infrastructure that submits transactions, the permissions controlling a wallet, or the systems responsible for authorizing withdrawals.
That distinction is important because Binance reported no evidence of leaked private keys during its initial investigation, despite confirming that hot wallets were compromised.
Why Do Exchanges Use Cold Storage?
Cold storage is designed to reduce the exposure of private keys to internet-connected environments.
An exchange may use offline signing systems, restricted hardware devices, or other isolated key-management arrangements.
The goal is to make unauthorized access more difficult, particularly through remote attacks.
Built for stronger key isolation
Cold storage keeps private-key material offline or within a restricted signing environment.
Access may require additional authorization, specialized devices, or controlled procedures.
Main advantage: Reduced exposure to certain internet-based threats.
Main trade-off: More operational complexity and potentially slower access to funds.
Cold storage can make it harder for attackers to obtain private keys remotely.
However, it cannot automatically protect an exchange from every infrastructure failure, insider threat, malicious approval, or compromised authorization process.
The U.S. Securities and Exchange Commission explains these distinctions in its Crypto Asset Custody Basics investor bulletin .
Hot Wallet vs. Cold Wallet: Exchange Security Comparison
| Security factor | Exchange hot wallet | Exchange cold storage |
|---|---|---|
| Typical role | Operational transactions | More restricted asset storage |
| Internet exposure | Connected environment | Keys offline or isolated |
| Withdrawal processing | Generally more convenient | May require additional steps |
| Remote attack exposure | Generally greater | Generally reduced |
| Authorization risks | Remain possible | Remain possible |
| Operational complexity | Requires secure online systems | Requires secure offline procedures |
| Complete protection? | No | No |
The comparison shows why hot and cold wallets serve different purposes.
But neither category, by itself, tells customers whether an exchange has sufficient reserves, effective internal controls, or a reliable incident-response process.
For a broader comparison of personal wallet options, see CoinFulcrum’s Best Crypto Wallets for Beginners .
Six Security Layers That Matter More Than Wallet Labels
The Binance incident illustrates why an exchange cannot rely on one security feature.
A strong custody model needs several controls working together.
1. Private-Key Protection
Private keys authorize cryptocurrency transactions. Protecting them from unauthorized access is fundamental.
Exchanges may use offline signing systems, hardware security modules, or other specialized key-management technology.
However, keeping keys protected does not automatically guarantee that every transaction submitted for signing is legitimate.
2. Transaction Authorization
Before an exchange sends cryptocurrency, its systems need to determine whether the transaction is permitted.
Controls may include withdrawal verification, transaction limits, multiple approvals, and restrictions on wallet permissions.
If an attacker can bypass or misuse authorization systems, private-key isolation may not be enough to prevent a loss.
3. Employee and Infrastructure Security
Exchange employees and technical systems can have access to sensitive infrastructure.
Compromised devices, stolen credentials, malicious software, or improperly restricted permissions can create opportunities for attackers.
Binance initially identified a potentially compromised employee laptop as one possible element of the incident.
Its later statement described additional breach points, while emphasizing that the investigation remained incomplete.
4. Monitoring and Withdrawal Controls
Exchanges may monitor unusual transaction patterns, unexpected withdrawal activity, and suspicious access attempts.
Security teams can also temporarily restrict transactions while investigating a threat.
These measures may reduce additional exposure, although they can also temporarily prevent legitimate customers from accessing funds.
5. Reserve Management and Transparency
An exchange must consider whether it has sufficient assets to meet its obligations to customers.
Proof of Reserves systems can help users evaluate certain asset-backing claims.
However, a reserve snapshot does not necessarily provide a complete picture of liabilities, financial condition, or operational security.
6. Incident Response and Recovery
Even well-designed systems can experience security failures.
When an incident occurs, important questions include:
- How quickly was suspicious activity detected?
- Were additional unauthorized transfers prevented?
- Were customers informed promptly?
- What assets were frozen or recovered?
- How will any customer shortfall be addressed?
- Will an independently reviewable incident report follow?
An exchange’s response can be as important as the safeguards it had before an incident.
Why the Binance Incident Is More Than a Hot Wallet Story
A common reaction to a major exchange hack is to ask why the affected assets were not simply kept offline.
That question is understandable, but it overlooks how cryptocurrency exchanges operate.
Platforms need systems capable of processing legitimate transactions.
Those systems involve software, authorization rules, access controls, and connections to blockchain networks.
The Binance incident shows why security must cover the entire transaction process, not just the location of private keys.
A compromised hot wallet does not necessarily mean attackers stole its private keys.
Unauthorized transactions can potentially result from failures involving permissions, transaction approvals, infrastructure, or other components.
The precise mechanism in the Binance incident should be assessed using verified technical findings rather than assumptions.
Why Coinbase and Kraken Reviewed Security After the Binance Hack
Reuters reported on October 31 that cryptocurrency exchanges were moving to strengthen defenses following the Binance incident.
Coinbase said it made precautionary adjustments to systems used to store cryptocurrency keys offline.
Kraken said it was monitoring the situation and reviewing its defenses.
Industry executives also discussed the potential value of faster information sharing when major cryptocurrency security incidents occur.
These responses demonstrate that exchange security is an ongoing process.
A system considered secure today may need reassessment as new attack techniques and vulnerabilities emerge.
Importantly: Precautionary security changes are not evidence that Coinbase or Kraken experienced a related compromise.
Readers interested in comparing exchange features can consult our Best Crypto Exchanges for Beginners .
What Is Proof of Reserves, and Can It Prove an Exchange Is Safe?
Proof of Reserves has become an important part of the discussion surrounding cryptocurrency exchange transparency.
In simple terms, Proof of Reserves is a method an exchange may use to demonstrate that it controls certain cryptocurrency assets at a particular point in time.
Some systems also allow customers to verify that their account balances were included in a published calculation.
However, several limitations matter.
What Proof of Reserves Can Help Show
- Whether certain assets were held at a specific time.
- Whether particular wallets were included in a reserve calculation.
- Whether customers can verify inclusion of their balances.
- Whether the exchange reports sufficient backing for covered assets.
What Proof of Reserves May Not Show
- All financial liabilities or obligations.
- Whether assets are borrowed or otherwise encumbered.
- Whether the exchange’s security controls are effective.
- Whether unauthorized withdrawals could occur later.
- Whether the company can remain financially solvent.
This is why Proof of Reserves should not automatically be treated as equivalent to a comprehensive independent financial audit.
Following the October 2026 incident, Binance said it planned to publish updated reserve information by November 2.
That was a stated target at the time of its October 30 announcement, not confirmation that the report had already been completed.
Can an Exchange Freeze Withdrawals Even If It Uses Cold Storage?
Yes.
Cold storage describes a method of protecting private keys. It does not guarantee uninterrupted access to an exchange account.
An exchange may temporarily restrict withdrawals because of security concerns, technical problems, liquidity issues, or other operational circumstances.
During the Binance incident, the exchange temporarily suspended withdrawals while performing security reviews.
This illustrates an important difference between holding cryptocurrency through an exchange and managing a personal self-custody wallet.
With an exchange, the platform generally controls the systems that authorize withdrawals.
With self-custody, the user controls the relevant private keys or recovery credentials, but also assumes responsibility for protecting them.
Neither arrangement eliminates risk.
For a detailed walkthrough of self-custody, see our guide to moving crypto off an exchange safely .
Exchange Custody vs. Self-Custody: What Changes?
The distinction between hot and cold wallets is different from the distinction between custodial and non-custodial storage.
Hot and cold describe how keys are protected and accessed.
Custodial and non-custodial describe who controls those keys.
| Question | Exchange custody | Self-custody |
|---|---|---|
| Who controls the keys? | Exchange or custody provider | User |
| Who authorizes withdrawals? | Provider’s systems | User’s wallet credentials |
| Can access be restricted? | Provider may restrict withdrawals | Network or wallet limitations may still apply |
| Who protects recovery information? | Primarily provider | Primarily user |
| Main risks | Provider, operational, and custody risks | Key loss, scams, user mistakes, device risks |
| Customer support | Usually available | May be limited or unavailable |
For beginners, the key lesson is not that one arrangement is universally better than the other.
It is that different custody models create different responsibilities and different potential failure points.
What Happens to Customer Funds When an Exchange Is Hacked?
There is no single outcome that applies to every cryptocurrency exchange security incident.
The consequences depend on the platform’s financial resources, the assets affected, its contractual obligations, the applicable legal framework, and whether stolen funds can be recovered.
Some exchanges may use emergency funds or company resources to address customer losses.
Others may face significant financial difficulties.
A promise to cover losses should not be confused with completed reimbursement.
Three Important Terms
Frozen Assets
Assets restricted from movement through certain blockchain or token-issuer controls.
Freezing does not necessarily mean the assets have been returned to their owner.
Recovered Assets
Assets that have actually been returned or placed under authorized control.
Recovery may involve law enforcement, exchanges, or other parties.
Replacement Reserves
Assets provided from company resources to replace missing funds.
These are different from recovered stolen assets.
Customer Reimbursement
The process of restoring affected customer balances or otherwise compensating losses.
Its timing and terms depend on the circumstances.
These distinctions matter when evaluating exchange announcements after a major security incident.
How Can Beginners Evaluate Crypto Exchange Security?
No publicly available checklist can guarantee that an exchange will never be hacked.
However, asking better questions can help users understand the risks involved.
- Custody: Does the exchange explain how it safeguards customer assets?
- Account protection: Does it offer strong authentication and withdrawal security controls?
- Transparency: Does it publish meaningful information about reserves, liabilities, and security practices?
- Incident history: How has the platform responded to previous security problems?
- Withdrawal access: What restrictions or delays may apply during emergencies?
- Customer protections: What contractual protections, insurance arrangements, or emergency resources exist?
- Regulatory status: Which legal entities provide services in your jurisdiction, and what rules apply?
- Independent verification: Are security and financial claims supported by reliable third-party evidence?
A platform’s marketing claims should not replace independent research into its security, custody arrangements, and operating history.
Crypto Exchange Security Resources for Beginners
If you are researching cryptocurrency platforms or considering how different custody arrangements work, the following resources may help.
Compare Cryptocurrency Exchanges
CoinFulcrum’s exchange comparison explains fees, supported features, security considerations, and account limitations.
Understand Self-Custody
Our self-custody guide explains wallet setup, blockchain networks, transaction verification, and common transfer mistakes.
Explore Coinbase Account Features
Coinbase is one example of a centralized cryptocurrency platform that readers may wish to research.
Its account features, custody arrangements, fees, and availability should be evaluated independently before opening an account.
Optional referral link: Explore Coinbase
Affiliate/referral link: CoinFulcrum may receive compensation if you sign up or take a qualifying action. This is not a security endorsement, investment recommendation, or guarantee of customer protection.
Readers interested in hardware wallets and other cryptocurrency tools can also explore our crypto research and security tools guide .
Five Lessons From the Binance Hack That Will Remain Relevant
Lesson 1: Hot Wallets Serve an Important Purpose
Online transaction infrastructure helps exchanges process withdrawals and other operational activity.
The challenge is securing those systems against unauthorized use.
Lesson 2: Cold Storage Is Not a Complete Security Strategy
Keeping private keys offline can reduce certain threats.
But exchanges also need secure permissions, infrastructure, and transaction approval processes.
Lesson 3: Customer Balances Depend on More Than Wallet Security
Customers need to understand whether an exchange has sufficient assets and resources to meet its obligations.
Proof of Reserves can provide useful information, but it has limitations.
Lesson 4: Security Incidents Can Affect Access
An exchange may temporarily restrict withdrawals during an investigation.
That operational risk exists even when the platform uses offline storage.
Lesson 5: Security Claims Need Ongoing Verification
Initial announcements may change as investigators learn more.
Readers should distinguish confirmed facts, company statements, independent findings, and unresolved questions.
Frequently Asked Questions
What is the difference between a hot wallet and a cold wallet?
A hot wallet operates in an internet-connected environment, while a cold wallet keeps private keys offline or isolated. Exchanges may use both for different operational purposes.
Why do exchanges use hot wallets if cold wallets are more secure?
Hot wallets help exchanges process routine cryptocurrency transactions efficiently. Cold storage generally reduces certain remote attack risks, but it can require additional steps to access funds.
Did the Binance hack prove cold wallets are unsafe?
No. Binance confirmed that its hot wallets were compromised. The full incident investigation was still ongoing at the time of its October 30 update.
Can hackers steal crypto without stealing private keys?
Unauthorized transfers may occur through compromised permissions, transaction authorization systems, or other infrastructure. The precise mechanism depends on the incident.
Did Coinbase get hacked after the Binance incident?
Reuters reported precautionary changes to Coinbase’s offline key-storage systems. That reporting did not establish a related Coinbase breach.
Does Proof of Reserves guarantee customer funds are safe?
No. Proof of Reserves can provide information about certain asset holdings and backing calculations. It does not automatically prove financial solvency or eliminate cybersecurity risks.
Can an exchange freeze withdrawals while customer assets are in cold storage?
Yes. Withdrawal access depends on the exchange’s systems, policies, and operational status, not simply whether some assets are held offline.
Is self-custody automatically safer than using an exchange?
No. Self-custody reduces dependence on a third-party custodian but places more responsibility on the user to protect private keys, recovery information, and transaction approvals.
Final Thoughts: The Real Lesson About Hot and Cold Wallets
The Binance hack has renewed attention on one of cryptocurrency’s most important security questions: how do exchanges protect the assets they control?
Hot wallets help exchanges process transactions. Cold storage helps reduce certain forms of online exposure.
But neither approach, on its own, guarantees that customer assets are protected.
Exchange security also depends on authorization controls, employee access, infrastructure protection, reserve management, monitoring, and incident response.
For beginners, understanding these layers is more useful than assuming that a platform is safe simply because it advertises cold storage.
The broader lesson is simple: protecting cryptocurrency requires understanding who controls the keys, how transactions are authorized, and what happens when security systems fail.
Continue Learning About Crypto Security
Explore CoinFulcrum’s beginner guides to understand wallet security, self-custody, and exchange risks before making decisions about cryptocurrency storage.
Explore Crypto Wallet Security Understand Self-CustodySources and Further Reading
-
Binance — Security Incident Update #2,
October 30, 2026.
Read the official Binance statement . -
Reuters — Crypto Exchanges Call for
Quick Moves to Bolster Defenses After Binance Heist,
October 31, 2026.
Read the Reuters report . -
U.S. Securities and Exchange Commission —
Crypto Asset Custody Basics for Retail Investors,
December 12, 2025.
Read the SEC investor bulletin . -
CoinDesk — Binance Uncovers Wider Breach
in $6.3 Billion Exploit,
October 30, 2026.
Read the technical investigation coverage . -
CoinDesk — Binance Hack Drained Wallets
Backing Customer Assets,
October 29–30, 2026.
Read the reserve analysis .
News context reviewed October 31, 2026. Investigative findings, withdrawal availability, and reserve information may change. Refer to official announcements and independent reporting for subsequent developments.