After Binance's $6.3bn hack: where should a crypto business keep its money?

The short answer

Keep on an exchange only what you trade. Binance says it has covered about 95% of the $6.3bn stolen from it on 29 October 2026, so on paper its customers lost nothing. They still couldn't withdraw for about two and a half days. Operating cash belongs in a fiat account in the company's own name, with a second account elsewhere as the backup.

• About $6.3bn was taken from Binance wallets in roughly 20 minutes from 20:05 UTC on 29 October (TRM Labs).
• Crypto withdrawals reopened from 1 November; fiat withdrawals in US dollars and dirhams on 2 November.
• In the first 9.5 hours, customers took out $4.65bn and put in $1.01bn (Binance).

What happened at Binance

Hackers took about $6.3bn from Binance wallets across 10 blockchains late on 29 October (UTC), already 30 October in Abu Dhabi. The FBI blames North Korea's TraderTraitor group.

Binance suspended withdrawals but kept deposits open: money could go in, not out. It then bought back the stolen coins with its own treasury, part of its futures insurance fund and its SAFU emergency fund. It reported 90% covered on 31 October and about 95% on 1 November, with the rest in less liquid tokens it was still buying.

Binance's main entities are licensed in Abu Dhabi Global Market. Its regulator, the Financial Services Regulatory Authority (FSRA), said on 30 October that it is "engaging closely with Binance and monitoring the incident".

When withdrawals reopened on 1 November, customers took out $4.65bn and put in $1.01bn in 9.5 hours, a net $3.64bn. Binance says that is 2.1% of its $171bn in assets.

The loss was covered. Access wasn't.

On Binance's figures, customers lost nothing. The better question for a business is what it couldn't do between Thursday night and Sunday morning.

Your balance on an exchange is the exchange's promise to hand over the coins or the cash when you ask. While withdrawals are stopped, the promise still stands and you can't pay anyone with it. A firm with its whole treasury on Binance couldn't pay salaries or suppliers that weekend. Its balance still showed the right number.

Covering the loss is the exchange's job; keeping payroll moving while it does so is yours.

And this was the good case: a large exchange with reserves, which chose to absorb the loss and reopened within days. The failures further down show the bad case.

Three places, three different legal positions

The same €100,000 means something different depending on where it sits.

An EMI (electronic money institution) is licensed to hold your money but isn't a bank: it safeguards balances rather than insuring them. The UK's Financial Conduct Authority studied 12 payment and e-money firms that failed between 2018 and 2023. Customers were on average 65% short, and payouts took 2.3 years. Our article on whether your money is safe at an EMI has the detail.

A bank deposit is the only one of the three with a compensation scheme behind it. The cover has a ceiling per bank, and it does nothing if the bank decides it no longer wants crypto customers.

What past failures did to business customers

Celsius (2022): the terms decided who owned the coins. Celsius froze withdrawals in June 2022. On 4 January 2023, Judge Martin Glenn ruled that crypto in its "Earn" accounts belonged to Celsius, not to customers, because the terms of use they had accepted transferred ownership. Those customers became unsecured creditors.

FTX (2022): paid back in dollars, at the bottom. FTX filed for bankruptcy on 11 November 2022. Claims were valued in dollars on that day, with bitcoin at $16,871. The first payouts, to the smallest claims, started on 18 February 2025, 27 months later. Customers who had held bitcoin got cash at the 2022 price plus interest, not bitcoin.

Silvergate and Signature (2023): the money was safe, the rail closed. Silvergate shut its Silvergate Exchange Network, the 24/7 dollar rail many exchanges and trading firms used, on 3 March 2023. New York's regulator closed Signature Bank, home of the rival Signet network, on 12 March. Signature's deposits were protected, but its crypto clients were given until 5 April to move their money. The same weekend, Circle had $3.3bn of USDC reserves stuck at Silicon Valley Bank.

What MiCA changes, and what it doesn't

The EU's Markets in Crypto-Assets Regulation (MiCA) has applied to crypto firms since 30 December 2024, and its last transition period ended on 1 July 2026. For money kept at an EU-licensed crypto firm, three rules matter:

1. Your crypto is kept apart. Article 75 says crypto held in custody must be segregated from the provider's own estate, out of reach of its creditors in an insolvency. That is the Celsius problem, addressed in law.
2. Your cash goes to a bank quickly. Article 70 says client money other than e-money tokens must be placed with a bank or a central bank by the end of the next business day, in an account kept separate from the provider's own.
3. Liability is capped. If the provider loses your crypto through an incident it is responsible for, Article 75 caps what it owes at the market value when the loss happened.

MiCA has no compensation scheme for crypto, and nothing in it stops a provider pausing withdrawals during an incident. It also covers only firms authorised in the EU; Binance's main entities are regulated in Abu Dhabi. Our MiCA banking article covers what providers ask EU crypto firms for.

The split many crypto treasuries use

No published survey shows how much operating cash crypto businesses keep on exchanges, so this is a structure, not a statistic. A structure that answers each of the failures above has four buckets:

• The trading float. Only what the business needs to trade or settle in the next few days, on the exchange. Split across two venues if the float is large.
• The operating account. A fiat account in the company's own name, at an EMI or a bank, for payroll, rent, suppliers and tax. Nothing here depends on an exchange being open.
• The reserve. Months of costs at a bank, kept under the deposit insurance limit per bank where the amounts allow.
• The backup account. A second provider, ideally with a different bank behind it, tested with a real payment so it works on the day it's needed.

Count the outgoings you would miss if your exchange stopped withdrawals for a week. That amount shouldn't be on the exchange.

Our view: the Binance weekend is the clearest case yet for a separate operating account. Nothing went wrong with the balance, and businesses still couldn't pay. This describes how businesses separate money; it isn't advice on what to hold or trade.

The hard part is the fiat account

Opening the fiat account is where most crypto businesses get stuck. Of the 148 providers on Finzil that publish a list of industries they refuse, 92 name crypto. 52 of all 298 profiles say they serve crypto businesses: 13 banks, 19 EMIs and 20 other payment and crypto firms.

Even among those 52, read who actually holds the money. Nebeus, added to Finzil on 3 November, gives a company a euro IBAN in its own name. There's no monthly fee and an outgoing SEPA transfer costs €3.50: a cheap route between stablecoins and euros.

But Nebeus doesn't issue the IBAN. One of three partner payment institutions does, assigned when you activate. Nebeus's terms say the euros held there "are not covered by national deposit guarantee schemes".

Payments also go only to and from accounts in the company's own name, so it works as an on-ramp and off-ramp, not for paying suppliers. Nebeus says it holds a MiCA authorisation from Spain's CNMV; it wasn't on the CNMV or ESMA registers when we checked on 3 November.

Whichever provider you look at, ask three things: which company holds the money, under which licence, and what happens to it if that company fails.

What to do this week

1. List where your money sits today, by provider and legal entity, with the amount and what it pays for.
2. Search your exchange's terms for "title" and "ownership". If ownership passes to the platform, or it may lend or use your assets, you are a creditor, not an owner. That was the Celsius ruling.
3. Move operating cash off the exchange into a fiat account in the company's name. Keep a trading float that covers days, not months.
4. Open a second account before you need it. When Silvergate and Signature closed in March 2023, their crypto clients had a few weeks to find another bank, at a time when few were taking crypto firms on.
5. Check what protects each balance. Bank: which deposit scheme, up to what limit. EMI: which bank holds the safeguarded money. Exchange: which regulator, and whether MiCA's custody rules apply.

Exchanges, brokers and custodians will be asked for their MiCA licence first. A software company paid partly in crypto should describe the business first and the crypto second. Our pieces on Revolut's crypto licence and stablecoin payments into a business account cover both cases.

Finzil checks your licence, country and owners against the published rules of 298 providers, and shows who holds the money at each. Check your company.

Questions people ask

Is money on a crypto exchange protected like a bank deposit?

No. No deposit insurance scheme covers balances on a crypto exchange. Under MiCA, EU-authorised firms must keep clients' crypto apart and place client cash with a bank by the next business day. Nobody compensates customers if assets go missing.

Did Binance customers lose money in the October 2026 hack?

Binance says no. It reported covering about 95% of the roughly $6.3bn stolen by 1 November 2026, from its own funds, and pledged to cover the rest. Customers couldn't withdraw for about two and a half days.

Should a crypto company keep its fiat on an exchange?

Only what it needs for trading. Payroll, rent and tax sit better in a fiat account in the company's name at a bank or EMI, with a second account elsewhere. Binance's October 2026 freeze stopped payments without any loss on paper.

How long did FTX customers wait for their money?

FTX filed for bankruptcy on 11 November 2022. Payouts to claims under $50,000 began on 18 February 2025, in cash at November 2022 prices, with bitcoin valued at $16,871.

Sources: ADGM FSRA statement, 30 October 2026; Binance security incident updates 1–6, 29 October to 3 November 2026; Central Banking, 2 November 2026; The Guardian, 30 October 2026; CBS News and Gulf Business, 2 November 2026; CoinDesk via Yahoo Finance, 2 November 2026; Regulation (EU) 2023/1114 (MiCA), Articles 70 and 75; In re Celsius Network, memorandum opinion of 4 January 2023; FTX case filings (Kroll); FCA CP24/20; provider profiles on Finzil (298), checked to 3 November 2026. General information, not financial, investment or legal advice.