Main Takeaway: A balance on an exchange is a record in the exchange's ledger, and taking coins out is a request the exchange has to approve. From Mt. Gox in 2014 to Binance in October 2026, exchange incidents have followed a few repeating patterns, and in most of them users waited on the platform's decision to get their coins back. Self-custody moves the keys, and the work of protecting them, to you.
What does an exchange balance actually represent?
When you buy crypto on an exchange, the coins usually sit in wallets the exchange controls, alongside everyone else's. Your account shows your share as an entry in the exchange's own database.
Coins only leave when you ask for a withdrawal and the exchange signs a transaction from one of its wallets. That step depends on the exchange's systems, policies and solvency on the day you ask. Our guide on where your crypto is actually stored covers the mechanics in more detail.
A short history of exchange incidents
| Year | Platform | What happened | What users faced |
|---|---|---|---|
| 2026 | Binance | A security incident led to unauthorized withdrawals from exchange wallets | Deposits and withdrawals paused. Binance says it will cover all losses |
| 2026 | Bitget | Unauthorized transfers from part of its hot wallets | Withdrawals paused while Bitget said its protection fund covered the loss |
| 2025 | Coinbase | Bribed support contractors took customer personal data. Coinbase said no passwords, private keys or funds were exposed | The data raised the risk of convincing impersonation scams |
| 2025 | Bybit | About $1.5 billion in ETH left a cold wallet after signers approved a transaction whose details had been tampered with | Bybit covered the loss and kept withdrawals open |
| 2022 | FTX | Withdrawals halted on November 8 and the exchange filed for bankruptcy three days later | Repayments began in February 2025, valued at November 2022 prices |
| 2022 | Celsius | The lending platform paused withdrawals in June, citing market conditions, and filed for bankruptcy a month later | Balances stayed frozen through the bankruptcy process |
| 2019 | QuadrigaCX | Customer funds became unreachable after the founder's death, and regulators later found they had been misused | Claims went through bankruptcy proceedings |
| 2014 | Mt. Gox | About 850,000 BTC reported lost and the exchange filed for bankruptcy | Creditor repayments in BTC began in July 2024, a decade later |
The latest example: Binance, October 2026
Binance reported a security incident on October 29, 2026 and suspended deposits and withdrawals. Binance's preliminary finding is that the compromised laptop of a DevOps engineer gave an attacker access to a service that submits withdrawal transactions, and that no wallet private key leaked. Binance says roughly $3 billion has been frozen on chain with partners including Tether and Circle, that it will cover all losses and that a full post-mortem will follow. As of October 30, no date had been set for withdrawals to resume. ELLIPAL has not independently verified these figures.
Bitget described a similar pattern in September, covered in our Bitget hot wallet incident write-up.
Three patterns behind these incidents
The platform fails as a business. Mt. Gox, QuadrigaCX, Celsius and FTX all ended in bankruptcy. Once that happens, an account balance becomes a claim against the company, and the timing and value of repayment are set by a court process.
The signing path is attacked. At Bybit, Bitget and Binance, the exchanges say the keys themselves were not stolen. What was compromised was the system or interface that decides what those keys sign. A key signs whatever reaches it through an approved path, so protecting the key and checking each request are two separate jobs. Bybit, Bitget and Binance have each said they would cover losses, which is a commitment from the platform rather than a property of the account.
Data leaks feed scams. The Coinbase case moved no funds directly. It gave scammers enough real detail to pose as support and ask people to move their coins themselves.
The common thread is control. In each case, getting coins out depended on a decision the user did not make.
What self-custody changes, and what it doesn't
| Factor | Balance on an exchange | Coins in self-custody |
|---|---|---|
| Who holds the keys | The exchange, across its hot and cold wallets | You, plus the job of keeping a backup |
| Moving coins out | A request the platform approves | Your own signature, one transaction at a time |
| If the platform pauses or fails | Your balance waits on its schedule or a court process | Your coins are unaffected |
| If something is signed in error | The platform can investigate and may cover losses | No one covers it for you, so checking each transaction is your job |
| Recovery if you lose access | The company's account recovery | Your seed phrase, if the backup reads back correctly |
A backup only counts if it restores. Our guide shows how to rehearse a seed phrase restore without a computer.
Which situation matches yours?
- You hold a balance on Binance right now. Binance says it will cover losses and share updates through official channels. Expect fake "support" messages offering to help move your funds.
- You trade actively. Many traders keep only their working balance on the exchange.
- You hold for the long term. Coins that sit still for months are the ones that gain the most from keys you control.
- You already self-custody. Exchange incidents do not touch your wallet. The scam wave that follows them can, through fake support and fake recovery sites.
Frequently Asked Questions
Is it safe to keep crypto on an exchange?
Several large exchanges have covered user losses after incidents. The tradeoff is control. Access to your coins depends on the exchange's systems and solvency, and the history above shows that access can pause for days or, after a bankruptcy, for years.
Does self-custody prevent these losses?
Self-custody takes the exchange out of the path, so a platform failure or a breach of its wallets does not reach coins held in your own wallet. The underlying risk stays with whoever holds the keys. You can still approve a harmful transaction, lose a backup or expose a seed phrase. Self-custody moves those checks to you rather than removing them.
Are user funds on Binance affected?
Binance says user funds are safe and that it will cover all losses from the October 29 incident. It has not announced when withdrawals will resume.
What is the first step toward self-custody?
Choose a wallet, write down its seed phrase backup and store it offline, then test a restore before you rely on it. Many people start with a small amount and move more once the routine feels familiar.
How can I spot a fake exchange support message?
A message asking for your seed phrase, your login codes or a transfer to a new "safe" address is a common sign of a scam, especially in the days after a major incident. Use only the official channels listed on the exchange's own website.
About ELLIPAL
ELLIPAL has been on the market since 2018, with more than 1 million users in 140+ countries. ELLIPAL wallets support 10,000+ tokens across 45+ chains and follow the BIP39 and BIP44 wallet standards.
For a plain comparison of the two ways to hold crypto, read our guide to crypto wallets and exchanges.