When a crypto exchange is hacked, who pays? Insurance, reimbursement and what the law says

When hackers break into a crypto exchange, the first question customers ask is simple: who covers the loss? The honest answer is that it depends on the exchange, not on any government. This guide explains why, what has happened in recent cases, and what to check before you trust a platform with your crypto.

If you’re a Binance customer, see the Binance hack: what users should do now.

The short answer

No government safety net

The FTC says crypto held in accounts isn’t insured by the government the way US dollars in an FDIC-insured bank account are. If the company holding your crypto goes out of business or is hacked, it says, the government has no obligation to step in to help you get your money back.

The UK is similar. The FSCS says it can only protect products and activities regulated by the FCA or the PRA, and that it can’t protect you if a crypto platform goes out of business. In Canada, CIPF lists crypto assets as excluded from its coverage. Some products that hold crypto, such as ETFs bought through a broker, are treated differently.

See is your crypto insured? for the detail, including the UK’s new regime from 2027.

When exchanges pay out themselves

In practice, customers of large exchanges have often been made whole by the exchange itself. That’s a business decision, not a legal guarantee.

• Binance, October 2026. After about $6.3 billion was stolen, Binance said “user funds are safe” and that it would “cover all losses”, using its emergency protection fund and company money. See the $6.3 billion Binance hack.
• Coinbase, 2025. After criminals bribed customer support staff for personal data and used it to trick customers into sending them crypto, Coinbase said it would voluntarily reimburse eligible retail customers. Its 2025 annual report says it paid $311.2 million in cash for the incident, including those reimbursements and direct legal costs. See the Coinbase data breach.

Two things decide whether this happens: whether the exchange wants to pay, and whether it has enough money to do so. A smaller platform hit by a large theft may simply not be able to.

Private insurance

Some platforms and the custodians they use carry private insurance. In Canada, for example, the Ontario Securities Commission’s 2026 decision on Newton says most of its clients’ crypto is held with custodians that are regulated trust companies and carry insurance against hacks, key theft and insider theft.

Insurance isn’t a blanket guarantee. Policies have limits and conditions, and they may not cover every loss or every asset. If a platform advertises insurance, find out what it covers and up to how much.

What the law makes firms tell you

Some regulators require platforms to spell this out in advance. Under California’s Digital Financial Assets Law, a covered firm must give you disclosures before doing business with you, including:

• whether your crypto is covered by any government insurance or guarantee, or by private insurance against theft or loss;
• its liability for unauthorized, mistaken or accidental transfers, how you report them and your error resolution rights.

See California’s DFAL crypto license.

A hack of the exchange vs a hack of your account

These are different situations. When the exchange’s own systems are breached, as Binance says happened in its case, the question is whether the platform will and can cover the loss. When someone gets into your account using your password or one-time codes, the platform’s terms on unauthorized transfers become central, so read them before you need them, and secure your own account. See SIM swaps and two-factor authentication.

If the exchange can’t cover the losses

If a hack, or anything else, leaves an exchange unable to pay its customers, it may end up in bankruptcy. Then the platform’s terms of use can decide whether your coins are still yours. In 2023, a US bankruptcy court ruled that crypto in Celsius’s Earn accounts had become Celsius’s property. See what happens to your crypto if an exchange goes bankrupt.

A checklist before you trust a platform

1. Read the custody and liability terms. Is your crypto held for you, separate from the company’s own assets?
2. Ask about insurance. What does it cover, which assets, and up to what limit?
3. Look for regular reserve reporting. See proof of reserves explained.
4. Check regulation where you live. Licensing rules such as California’s DFAL and Canada’s platform rules add disclosure and custody requirements.
5. Don’t keep more on an exchange than you need. See hot vs cold wallets.
6. Keep records of your balances and transactions, so you can prove what you held if something goes wrong.