In short
- If an exchange that holds your crypto is hacked, shuts down or goes bankrupt, you may lose access to it. US SEC staff wrote this on 12 December 20251.
- In your own wallet, if your keys are lost or stolen, you may also lose access, the same SEC page says1.
- Proof of Reserves reports are not audits, and they show only one moment in time. Staff of the PCAOB, a US audit regulator, warned of this on 8 March 20237.
- Mt. Gox, an exchange, went bankrupt in February 2014. Its customers got their first bitcoin repayments in July 20244.
What does it mean when an exchange holds my crypto?
It means the exchange controls the private keys of your coins. A private key is the secret code that moves crypto. Your account shows a balance, but the keys are with the exchange1.
Staff of the US SEC, the US market regulator, call this third-party custody. The exchange may keep the keys in hot wallets, which are online, in cold wallets, which are offline, or in both. When you keep the keys yourself, in your own wallet, it is called self-custody1.
What can go wrong with crypto on an exchange?
SEC staff say that if the exchange is hacked, shuts down or goes bankrupt, you may lose access to your crypto1. Here is what that can look like:
- Paused withdrawals. An exchange can stop withdrawals for a time. On 30 October 2026, after a hack, Binance said it had paused withdrawals while it completed security checks2. Our news article Binance hack: is my money safe? has the details.
- Bankruptcy. In a bankruptcy, the company’s terms of use can decide whose coins they are. Celsius, a crypto lender and not an exchange, froze withdrawals in June 2022 and went bankrupt in July. In January 2023, a US bankruptcy judge ruled that, under its terms, the coins in its Earn accounts belonged to Celsius. That was about $4.2 billion, in about 600,000 accounts. Those customers became unsecured creditors: people who are owed money but are not first in line. What they get back depends on the bankruptcy plan3.
- Long waits. Mt. Gox, once one of the world’s largest places to trade crypto, went bankrupt in February 2014 after a series of thefts. Its customers got their first bitcoin repayments in July 2024, ten years later4. On 16 October 2026, the trustee in charge of its repayments said many customers were still not paid. Many had not finished the steps needed to get paid. With the court’s permission, the trustee moved the deadline from 31 October 2026 to 31 October 20275.
- Lending your coins. Some companies that hold crypto for customers use it for their own purposes, such as lending. Some mix customers’ coins together instead of keeping them apart. SEC staff suggest asking whether yours does this, and whether it needs your consent1.
What can go wrong in my own wallet?
In your own wallet, you carry the risks yourself. If your wallet is lost, stolen, damaged or hacked, you may lose access for good, SEC staff say1.
- Lost keys. A private key cannot be changed or replaced. Many wallets give you a seed phrase, a list of random words that can restore the wallet. If you lose both the key and the seed phrase, no help desk can bring your coins back. SEC staff say to keep the seed phrase in a secure place and never share it1.
- Hot and cold wallets. A hot wallet is online: easy to use, but open to cyber attacks. A cold wallet, such as a device kept offline, is generally more secure from those attacks. But the device can be lost, damaged or stolen1.
- Signing a scam. In a scam called approval phishing, people are tricked into signing a transaction. It lets a scammer spend some tokens in their wallet, and take them at any time. Chainalysis, a company that tracks crypto payments, estimated that people lost more than $2.7 billion to such scams since 2021. The Record reported this in July 20246.
Exchange account or your own wallet?
Table: the two choices side by side.
| Question | Exchange account | Your own wallet |
|---|---|---|
| Who holds the private keys? | The exchange1 | You1 |
| What can go wrong? | A hack, paused withdrawals, a shutdown or a bankruptcy123 | Lost keys, a lost or hacked device, a scam that tricks you into signing16 |
| If it goes wrong | You may lose access, or wait years for repayment14 | You may lose access for good1 |
| Who can help? | The exchange’s support. In a bankruptcy, a court process3 | Nobody can replace a lost key1 |
| Can I trade from it? | Yes, on that exchange, by hand or with a tool through an API key11 | Not on an exchange like Binance: you first send the coins there |
| What can I check? | Withdrawal settings, two-step login, key permissions, Proof of Reserves18911 | Where your seed phrase is kept, and what you sign16 |
Does Proof of Reserves show my money is there?
It shows part of the picture, at one moment. In a Proof of Reserves, an exchange shows the coins it holds for its customers.
Binance’s page says its report shows that customer assets are backed 1:1, coin for coin. Each user can also check that their own balance was counted, with a tool called a Merkle tree8. On 31 October 2026, at about 13:00 UTC, the newest report on the page was dated 1 October 20268. After the hack, Binance said it will publish an updated Proof of Reserves once its repair work is complete2. At 19:33 UTC on 30 October, it said the results of a first snapshot should be ready by Monday 2 November12.
On 8 March 2023, PCAOB staff warned about such reports in general, not about one exchange7:
- They are not audits, and they give no meaningful assurance.
- They show assets at one moment, not whether the assets were used, lent or became unavailable after that.
- They may not cover what the company owes, or whether the assets were borrowed to look like enough reserves.
What can I set up if I trade on an exchange?
Where you keep each part of your coins is your decision. If you trade on an exchange, these settings can limit the harm when your own account or a key is attacked:
- A separate account or sub-account, with only the money you trade. On Binance, a regular user with identity verification and two-step login can open up to five sub-accounts. The main account moves money between them at once, with no fee, and each sub-account can have its own API keys10.
- A withdrawal whitelist. With it on, Binance lets you withdraw only to addresses on your list. Changing the list may pause your withdrawals for 24 to 72 hours9.
- Two-step login. SEC staff suggest strong passwords and multi-factor authentication, a second step when you log in1.
- Keys for trading tools. An API key lets a program, such as a trading bot, work in your account. Binance Academy says a trading bot should have trade access “but never withdrawal rights”. It also says to let each key work only from chosen IP addresses, and to cancel a leaked key at once11. More: what a trading bot can do with an API key.
None of these settings help if the exchange itself is hacked or fails.
How does ForecastsPro handle your money?
We make ForecastsPro, a paid AI trading app. ForecastsPro never holds your money, in any mode, and you never send us coins to trade. A new account starts in Off: analysis only, and no orders.
- Paper. Paper trading: no real money. Practice orders on Binance’s test system, with free testnet keys. You need no Binance account.
- Manual mode. No exchange key. The AI gives each trade, and you place it by hand on any exchange. Your coins stay wherever you keep them.
- Real money. Live trading: real money from your own Binance account. The app trades only in the account you connect, through a trade-only key restricted to our server’s IP address. It asks Binance what the key may do, and refuses a key that can withdraw or transfer. It checks again before every real-money analysis. Real money may be restricted in your country.
So the app can never move your coins off Binance, not even in an emergency. The coins in that account still carry the exchange risks above. Our Real money chapter says to use a separate Binance account or sub-account, with only the money you are ready to trade. We promise no profit: you can lose money, and the AI can be wrong. See our Risk Disclosure.
Questions and answers
Is it safe to leave crypto on Binance after the hack?
We cannot answer that for you, and this article is not financial advice. As of 31 October 2026, Binance says it will cover all losses from the hack212. It also says the results of a new Proof of Reserves snapshot should be ready by Monday 2 November12. The checks in this article apply to any exchange.
What does “not your keys, not your coins” mean?
It is a crypto saying. If someone else, such as an exchange, holds your private keys, you rely on them to give you your coins1.
Does Proof of Reserves prove an exchange can pay everyone?
No. PCAOB staff say these reports are not audits. They show assets at one moment. They give no assurance that the reserves will be enough later, or that customer assets will be protected7.
Will I get my money back if an exchange goes bankrupt?
Can a trading bot move my coins off an exchange in an emergency?
Only if its API key has the withdrawal permission. Binance Academy says a trading bot should have trade access but never withdrawal rights11. For Real money, ForecastsPro refuses any key that can withdraw or transfer. So it cannot move your coins off Binance, at any time.
How we checked this
We first read the sources on 30 October 2026, re-checked the Binance pages on 31 October 2026, and checked every sentence about ForecastsPro against its code and guide. This article is information, not financial, legal or tax advice.
ForecastsPro is not affiliated with or endorsed by Binance or any company named here. Found a mistake? Write to support@forecastspro.com.
Sources
- US Securities and Exchange Commission, Office of Investor Education and Assistance, investor bulletin (staff views), 12 December 2025. Crypto Asset Custody Basics for Retail Investors. Used for: third-party custody and self-custody, what a wallet stores, private keys and seed phrases, hot and cold wallets, the risk when a custodian is hacked, shuts down or goes bankrupt, custodians that use or commingle deposited coins, and strong passwords with multi-factor authentication.
- Binance, announcement, published 30 October 2026, updated the same day. Security Incident Update (2026-10-30). Used for: withdrawals paused while security checks are completed, Binance covering all losses, and an updated Proof of Reserves once the repair work is complete.
- TechCrunch, Jacquelyn Melinek, 4 January 2023. Bankruptcy judge rules Celsius Network owns users’ interest-bearing crypto accounts. Used for: Celsius as a crypto lender, its withdrawal freeze of June 2022 and its bankruptcy filing in July 2022, the bankruptcy judge’s ruling under its terms, about 600,000 Earn accounts with about $4.2 billion, and Earn customers as unsecured creditors, who often come after secured creditors and are paid under the bankruptcy plan.
- CNBC, Ryan Browne and MacKenzie Sigalos, 5 July 2024, published on NBC News. Mt. Gox begins repaying bitcoin to creditors a decade after exchange’s collapse. Used for: Mt. Gox as once one of the largest crypto trading venues, its bankruptcy in February 2014 after a series of thefts, the first repayments in bitcoin, and customers waiting ten years.
- MtGox Co., Ltd., rehabilitation trustee, notice of 16 October 2026 (English translation for reference). Notice Concerning Change of Repayments Deadline. Used for: repayments largely done for creditors who finished the required steps, many others not yet repaid because they had not finished those steps or for other reasons, and the deadline moved, with the court’s permission, from 31 October 2026 to 31 October 2027.
- The Record by Recorded Future News, Jonathan Greig, 18 July 2024. Crypto experts, law enforcement shut down network stealing billions through ‘approval phishing’. Used for: how approval phishing works, with a signed approval that lets the scammer take the tokens at will, and the estimate by Chainalysis of more than $2.7 billion lost since 2021.
- Public Company Accounting Oversight Board (PCAOB), Office of the Investor Advocate, investor advisory (staff views), 8 March 2023. Investor Advisory: Exercise Caution With Third-Party Verification/Proof of Reserve Reports. Used for: such reports are not audits and give no meaningful assurance, show assets at one moment, may not cover liabilities or borrowed assets, and give no assurance that reserves will be enough later or that customer assets will be protected.
- Binance, no date on the page, read 31 October 2026. Proof of Reserves. Used for: Binance’s statement that the report shows customer assets backed 1:1, one bitcoin more in reserves for each bitcoin a user deposits (coin for coin), the Merkle tree that lets users check their own balance was included, and the newest snapshot dated 1 October 2026.
- Binance help, published 9 July 2020, last updated 3 March 2025. How to Manage Withdrawal Settings for My Binance Account? Used for: with the whitelist on, withdrawals go only to addresses on your list, and changing the list may suspend withdrawals for 24, 48 or 72 hours.
- Binance help, published 6 December 2018, updated 29 September 2026. Binance Sub-Account Functions and Frequently Asked Questions. Used for: who can open sub-accounts, five for regular users, instant transfers with no fee from the main account, and API keys for each sub-account.
- Binance Academy, updated 26 May 2026. What Is an API Key and How to Use It Securely? Used for: what an API key does, trade access but never withdrawal rights for a trading bot, IP restrictions, and cancelling a leaked key at once.
- Binance, announcement, 30 October 2026, 19:33 UTC. Security Incident Update #2 (2026-10-30). Used for: Binance absorbing the losses, and the results of a first Proof of Reserves snapshot due by Monday 2 November.
ForecastsPro is an AI crypto trading bot with a hard-coded risk manager. See it work in the live demo: it is free and uses sample data, not real money.