For those who decide to participate in cryptocurrency, I usually offer a very simple piece of advice: choose platforms that are larger in scale and more stable in operation wherever possible.
The reason is not complicated. If a coin theft incident occurs, large platforms are usually better able to mobilize funds and absorb losses. When choosing a platform, this risk-resistance capacity is worth considering; of course, large scale does not guarantee that it will necessarily be able to pay compensation after an incident.
In the early hours of October 30, multiple hot wallets used by Binance for daily operations showed abnormal large transfers out. On-chain institutions preliminarily estimated that the outflow reached several billion US dollars. Binance subsequently suspended deposits and withdrawals to conduct a security check, stating that user funds were safe and that it would bear the relevant losses; stablecoin issuers such as Tether and Circle also participated in freezing the assets involved. For users, what they care about most at this point is whether the platform can honor its compensation commitment.
But if the pressure of compensation is placed on the platform every time, users are still in a somewhat passive position. Laws and contracts can specify what responsibilities a platform should bear, but when it actually comes time to pay, it still depends on whether it has enough money and whether it is willing to perform its commitments promptly.
No one wants the security of their assets to depend solely on the platform's financial resources and commercial reputation.
So the question arises: apart from waiting for the platform to compensate from its own reserves, is there a more reliable market-based approach? For example, before an incident occurs, insurance companies could be brought in to transfer part of the risk, while arrangements are made in advance for how customer assets are to be custodied, who bears compensation liability, and how compensation payments are delivered to users.
Following this question further, it appears that there really are solutions.
How is this done around the world?
To understand how such protection should be designed, we can first look at the approaches of Hong Kong, the European Union, Japan, South Korea, Singapore and New York State in the United States.
Hong Kong: compensation arranged in advance
Hong Kong's approach can be understood as: safeguard the coins in normal times, and also prepare the money for incidents in advance.
Under Hong Kong's regulatory requirements, customer assets custodied by licensed exchanges must be segregated from the company's money and held in trust by a qualifying subsidiary, meaning they are clearly held on behalf of customers and cannot be used as the company's own operating funds. In principle, 98% of customer coins must be held in cold wallets, with the keys controlling the assets kept separate from the network to reduce the chance of attack; a small number of approved circumstances may be exceptions.
The compensation arrangements must also be approved in advance by the Securities and Futures Commission (SFC), and the coverage amount is calculated at 50% of client assets held in cold wallets and 100% of client assets held in hot wallets and other storage methods. For example, if clients have deposited a total of RMB 100 million, of which RMB 98 million is in cold wallets and RMB 2 million is in hot wallets, the corresponding coverage to be arranged is RMB 51 million. This calculation concerns how much coverage the platform must prepare, and does not mean that each user will only be compensated for half of any lost coins; the specific amount of compensation will also depend on the actual loss and the corresponding arrangements.
This coverage may come from insurance, from a sum of money or coins specifically set aside by the platform in accordance with the rules, or from a qualifying bank guarantee, and these methods may be used in combination. Therefore, the compensation requirement for licensed platforms in Hong Kong should not be directly understood as meaning that all client assets are underwritten by external insurance companies. Even if insurance is purchased, if the insurer is also within the same group, it is still necessary to examine whether the risk has genuinely been transferred out. In addition, Hong Kong's Investor Compensation Fund does not provide a backstop for virtual asset trading.
European Union: Custodians Bear Liability
The European Union answers the question of "who is liable after coins are lost" more directly. The Markets in Crypto-Assets Regulation requires that a platform holding coins on behalf of clients compensate clients if it loses the clients' coins or the keys controlling the coins due to an incident for which it is responsible. The cap on this liability is calculated based on the market value of the lost assets at the time of the incident. If the platform can prove that the incident is unrelated to its custody services or operations, this compensation liability does not apply.
Clients' coins must also be separated from the platform's own assets, both legally and in actual management. The platform must also prepare a certain amount of coverage, which may be provided through its own funds, the purchase of insurance, or obtaining a similar guarantee. However, this coverage is calculated based on business categories and the company's fixed expenses, and is not automatically set at an amount equal to the coins users deposit. The fact that a platform is required to compensate and whether the platform will have sufficient funds to compensate at the relevant time must be considered together.
Japan: Additional Coins Must Be Set Aside
Japan requires that most client coins be held through secure methods such as cold wallets. For the portion that is held through exceptional custody methods genuinely for day-to-day liquidity, the value calculated in accordance with the rules may not exceed 5% of the total value of client coins. For this portion, the platform must also set aside its own coins of the same type and quantity, held separately, as coverage for performing its return obligation in the event of an incident.
For example, if the liquidity assets meeting the exceptional conditions include 10 bitcoins, the platform must set aside another 10 of its own bitcoins, and cannot substitute this with a statement that "there is enough cash on the books." If the company encounters problems, users may, within the scope provided by law, preferentially recover their share from client assets and these reserve coins. The funds must still be provided by the platform, but what must be prepared in advance and where users may recover from are clearer.
South Korea: Insurance or Reserve Funds
South Korea requires platforms to hold sufficient client coins by type and quantity, keep them separately, and place at least 80% of the value of client assets in cold wallets in accordance with the calculation method prescribed by regulators. To address hacking attacks and network failures, incident compensation must also be prepared. Platforms may purchase insurance, join mutual compensation arrangements, or set aside their own reserve funds, that is, a sum of money specifically for responding to incidents.
Such incident coverage must be at least 5% of the value of client assets other than those in cold wallets, calculated in accordance with the rules, and there are also minimum amount requirements. It requires platforms to set aside coverage for incidents on an ongoing basis, but does not mean that all losses caused by a single large-scale coin theft will be covered. The final amount that can be compensated will still depend on the total coverage and the actual loss.
Singapore: Separate the Assets First
Singapore first requires platforms to place client assets in trust accounts, separate from the company's own assets, making clear that these assets are held on behalf of clients. Under local guidance, control tools such as the private keys for at least 90% of relevant client assets must be safeguarded in cold wallets. Platforms must also explain what happens when their own fraud or negligence causes client losses; if there is insurance, they must also inform clients which circumstances are covered and how to make a claim.
Doing so can reduce the risk that, if the company encounters operational problems, clients' coins become commingled with the company's assets. However, coins that have already been stolen will not automatically be restored simply because they were placed in a trust account. The Singapore regulator also cautions that, even with these arrangements in place, clients may still wait a long time to recover assets after a platform becomes insolvent. Distinguishing who owns which assets and closing the gap left by theft are two different matters.
New York State: The custody chain must also be examined
In the United States, the analysis depends on the specific jurisdiction and business. Taking the relevant licensed business in New York State as an example, when a platform holds coins in custody for users, it must clearly distinguish client assets in its wallets and books, and must not treat those coins as its own money. A user entrusting coins to a platform for custody should not thereby become "lending coins to the platform." Institutions holding a local virtual currency business license must also obtain appropriate security for the benefit of clients, or place US dollars in a dedicated trust account, in a form and amount recognized by the regulator.
The guidance updated by New York State in 2025 further reaches other companies that actually hold the coins. If an exchange passes clients' coins to another company for custody, it must also arrange account identification and asset segregation so that those coins do not become collateral for the exchange's debts. For users, this is a reminder that opening an account in one app may involve another company actually managing the coins on your behalf behind the scenes.
Viewed together, these practices make the role of insurance clear. First, separate users' coins from the company's money to reduce misappropriation and confusion; when losses actually occur, determine liability according to the rules and cover them with pre-arranged insurance, funds or security. Each addresses part of the problem, and together they allow users to rely less on a platform raising money on an ad hoc basis after a failure.
If an exchange has insurance, how much can be paid out?
Such insurance is already being purchased in the market. For example, Hong Kong-licensed platform HashKey Exchange announced a custody insurance arrangement in August 2025, with an 18-month policy period covering at least 50% of custodial assets. Custodial assets here are the coins the platform holds in custody for clients; the arrangement also includes a reinsurance component, allowing the insurer to pass part of the risk on to others.
However, after insurance is purchased, what ordinary users care about most is still: if coins are actually lost, how much of my money can be compensated?
An exchange buying insurance for its own wallets and each user's account having its own insurance are two different things. Coinbase's approach is that it has purchased insurance for some digital assets against risks such as theft, including cyberattacks; however, losses where a user discloses or loses login credentials, causing the personal account to be accessed by others, are not within the scope of this insurance. It also cautions that total losses may exceed what the insurance can pay back. Even when "coins are missing" in the same way, how the incident occurred can affect whether compensation is available.
Next, consider the insured amount. When a platform says "we have US$100 million in insurance," it is necessary to distinguish whether this is the maximum payable for a single incident or the maximum cumulative amount payable under the entire policy during its term, and also whether multiple clients, businesses or group companies share it. If the total eligible losses reach US$500 million, this US$100 million clearly cannot be understood as a separate amount for each user; how it is ultimately allocated still depends on the insurance contract and relevant rules.
The insurance contract may also provide that a portion of losses is borne by the insured platform itself, which is the "deductible." In addition, the date on which the coin price is calculated for payment and which wallets are within the scope of coverage will also affect the final amount. For the same loss of 10 coins, the amount of compensation received may differ precisely because of these clauses.
There is also a very practical question: who gets paid first? If only the exchange can apply to the insurer, and the exchange has already collapsed, someone needs to handle the paperwork, determine where the payout is sent, and work out how users receive their share. When taking out insurance, the platform should clearly arrange how payouts will reach users.
Recommendations for individual users
It is very difficult for ordinary users to obtain the complete insurance policy relating to the theft of crypto assets held by an exchange, and it is even less likely that they would review the platform's insurance and custody arrangements from scratch just to deposit some coins. I therefore recommend focusing your efforts on a few things you can do yourself.
First, confirm to whom you have entrusted your coins.Open the account-opening agreement or the legal terms in your account and see which company you have contracted with. If the platform advertises that it is licensed, check the company name and licensed business on the official website of the relevant regulator. In principle, whichever jurisdiction issued its license is the jurisdiction whose regulatory rules it should follow. If you see insurance advertising, also note which company and which product are insured.
Set a cap on the assets you keep on an exchangeBefore becoming a user of any exchange, you can ask yourself: if this platform suspended withdrawals and the money could not be taken out for a while, would that affect my life and other arrangements? If so, you need to reconsider the amount you keep there. Spreading assets across different platforms can reduce reliance on any single platform, but you should also verify the company behind each one; opening several accounts within the same group does not necessarily diversify the risk.
Use the security features available in your account.Use a unique password, protect the email address linked to your account, and enable two-factor authentication so that logging in requires an additional confirmation beyond the password. Where the platform offers passkeys, hardware security keys or other verification methods, you can set them up according to the official instructions. It is also worth enabling a withdrawal address whitelist, which restricts transfers to addresses you have confirmed in advance. These measures mainly guard against misuse of individual accounts; as noted above, platform insurance does not cover some losses to individual accounts.
If you want to self-custody, start with a small amount.For assets you do not trade often, after understanding the process and the risks, you may consider moving them to a wallet where you control the private keys. But do not rush to move all your assets simply because you have heard that an exchange ran into trouble. First use a small amount to go through the receiving, backup and recovery process, and confirm that the mnemonic phrase, the set of words used to recover the wallet, can be properly stored offline, before deciding whether to increase the amount. Once you self-custody, sending to the wrong address or losing or disclosing the mnemonic phrase can likewise make assets unrecoverable, and that responsibility is yours to bear. This is also why I generally do not readily recommend that people use wallets where they control the private keys: the learning cost and the cost of secure custody are too high, and if something does go wrong, you cannot even find customer service.
If you have already encountered an anomaly, keep records first, then use official channels.Keep records of account balances, deposit and withdrawal records, transaction numbers, platform announcements and customer service tickets. When withdrawals are suspended, first determine whether it is platform-wide maintenance or a restriction on your own account; if you discover that someone has transferred assets without permission, you should immediately report it through the official channel and apply to restrict account operations. Where a loss must be declared, submit the materials in accordance with the announcement and retain the acceptance receipt and subsequent replies. Do not pay deposits or unfreezing fees to so-called customer service representatives who contact you privately in order to "speed up compensation," and never hand over your wallet mnemonic phrase, so as to avoid being defrauded a second time.
Summary
Returning to the beginning, when choosing a platform you should consider its scale and resilience to risk. I think everyone would hope that the next time users hear that "the platform has been attacked," they already have a clear protection arrangement in hand, know whom to contact and how to proceed next, and no longer have to refresh announcements while guessing how much the platform still has in reserve.
