10 Ways to Keep Your Funds Safe on a Crypto Exchange After the Binance Hack Reports

What We Know So Far

The reporting so far separates into official statements and outside estimates. Only the first group should be treated as firm.

• Binance said it is "aware of reports of a potential security issue" and "actively investigating", and that withdrawals were temporarily suspended on multiple networks as a precaution (TechCrunch, Gizmodo). It has not confirmed a hack or a total loss.
• Former CEO Changpeng Zhao wrote that it "does look like a hack on Binance" and that he expects all user funds to be fully covered. He no longer manages Binance, and this is an expectation, not a commitment by the company (TechCrunch).
• Tether CEO Paolo Ardoino said it froze more than 1.567 billion USDT, and Circle CEO Jeremy Allaire said it froze more than 800 million USDC in coordination with law enforcement (FinanceFeeds).
• Estimates of the amount that moved range from roughly $2 billion to $5.8 billion, depending on what is counted and which blockchains are included (The Block).
• Analysts reading the blockchain say the attacker used an Ethereum feature called EIP-7702 to take control of a Binance wallet. How they obtained that ability, whether through a stolen key, a compromised signing system or an insider, is not confirmed, and no one has been named (CryptoTicker).

We are following the story in our daily cybersecurity news briefing. Facts may change as Binance and investigators publish more.

1. Use a Unique, Strong Password and a Password Manager

Reused passwords are one of the most common ways exchange accounts are taken over. If a password from an unrelated site leaks, attackers try it everywhere.

Create a long, random password that you use only for this exchange, and store it in a reputable password manager. Do the same for the email account linked to the exchange.

2. Turn On Two-Factor Authentication, Preferably a Passkey or Security Key

Two-factor authentication stops most account takeovers even when your password is stolen. Rank your options like this: hardware security key or passkey first, an authenticator app second, SMS codes last because phone numbers can be hijacked.

Turn it on for logins and for withdrawals. Save the backup codes offline, not in your email.

3. Set an Anti-Phishing Code and Check Official Channels

Many exchanges let you set an anti-phishing code that appears in genuine emails from them. If an email claims to be from your exchange and lacks the code, treat it as fake.

Type the exchange address yourself or use a saved bookmark. Do not log in from links in emails, texts or social posts. See How can I tell if an email is phishing? for the warning signs.

4. Enable the Withdrawal Address Allowlist and Delay

An address allowlist means withdrawals can only go to addresses you approved earlier. Pair it with a withdrawal delay, if your exchange offers one, so new addresses cannot be used immediately.

If an attacker does get into your account, these two settings give you time to notice and lock it down. They do not help if the exchange itself is compromised, which is why the next steps matter.

5. Keep Only What You Can Afford to Have Delayed on the Exchange

An exchange holds your coins in its wallets and records what it owes you. If the exchange has a security incident, withdrawals can be paused for hours or longer, even when it later makes users whole.

Use the exchange for trading and conversion, and decide in advance how much you could live without access to for a while. Spread larger balances across more than one platform or move them off the platform entirely.

6. Move Long-Term Holdings to Self-Custody

With self-custody, you hold the private keys in a wallet you control, so no exchange failure can freeze or drain your coins. A hardware wallet is the usual choice for larger amounts.

Self-custody moves the responsibility to you. Buy hardware wallets only from the manufacturer, test with a small transfer first, and never enter your recovery phrase on a website.

7. Protect Your Recovery Phrase

Your recovery phrase is the master key to a self-custody wallet. Anyone who has it controls your funds, and nobody legitimate will ever ask for it.

Write it on paper or metal, store it offline in a secure place, and never photograph it, type it into a phone or computer, or keep it in cloud notes or email.

8. Secure Your Email and Phone Number

Your email account can reset your exchange password, so protect it with a unique password and strong two-factor authentication.

Ask your mobile carrier to add a port-out PIN or SIM lock to stop SIM-swap attacks, and remove your phone number from public profiles.

9. Review Connected Devices, API Keys and Approvals

Open your exchange security page and sign out sessions you do not recognize. Delete API keys you no longer use, and for the ones you keep, disable withdrawal permission and restrict them to trusted IP addresses.

If you use a self-custody wallet with decentralized apps, review and revoke old token approvals regularly.

10. Expect Scams After a Big Incident

Scammers move fast after news like this. Expect fake emails, texts, ads and social posts offering refunds, "compensation", account verification or help from "support".

• Official updates come from the exchange's verified channels, never from a direct message.
• No genuine support agent asks for your password, codes or recovery phrase.
• Do not install software or connect your wallet to a site because a message told you to.
• Be wary of anyone offering to recover lost crypto for a fee.

What to Do If Your Exchange Reports an Incident

Stay calm and work through these steps in order:

• Read only the exchange's official statements, reached by typing the address yourself.
• Do not panic-trade or rush to withdraw through links sent to you. Use the app or site you normally use.
• Check your account for activity you did not make, and change your password if anything looks wrong.
• Keep records of your balances, transactions and any messages from the exchange.
• Report fraud attempts to your local cybercrime or consumer protection agency.