Compensation After an Exchange Hack: What Twelve Crypto Providers Really Promise German Customers

When customer holdings are stolen from a crypto exchange, the exchange as a rule does not make good the loss, and no state body steps in either. That is the short answer, and it appears in those or similar words in the providers' own public documents. On September 8, 2026 we retrieved the security, legal and protection-fund pages of twelve providers that address customers in Germany with German-language sites, and looked at what is actually promised there. For seven of them a solid statement could be evaluated. Exactly one provider names a fund of its own with a figure attached. Not a single one promises a private account reimbursement for stolen coins.

The occasion is recent. In the first week of September 2026, around $322 million flowed out of crypto systems according to a count by The Crypto Times, of which roughly $320 million came from the Liquid Network peg-out alone, reported by Bloomberg on September 7. We described the incident the same day in our report on the Liquid Network peg-out. The second half of the question stayed open there, and it is the subject here: who actually pays when your balance is hit?

Who reimburses stolen coins? The legal position in three sentences

Germany has two statutory safety nets for money held at a financial company. Deposit guarantee is the statutory claim to have your bank balance replaced up to a fixed amount if the bank fails. Investor compensation is the counterpart for securities business: it applies when an investment firm can no longer hand over securities or funds from such business.

Both nets are tied to a precondition that crypto-assets usually do not meet. On its consumer page on deposit guarantee and investor compensation, BaFin writes on the question of whether these systems cover crypto-assets: “As a rule, no. In particular, the assets known as cryptocurrencies, which became popular recently, are mostly not protected. Protection applies only if the crypto-asset counts as a security or if it involves fund units investing in crypto-assets.” The consumer association Verbraucherzentrale puts the same point more briefly in its risk overview: crypto investments have no deposit guarantee.

The difference between failure and theft

Even where a net applies, it covers a different case from the one at issue here. Deposit guarantee and investor compensation are built for the failure of the company, meaning insolvency or an officially established inability to pay. A theft at a provider that stays open afterwards and remains solvent does not trigger these nets at all. How the insolvency case differs from this, and what segregation of your coins means there, we took apart on August 18, 2026 in our article on segregation at an insolvent crypto exchange.

Deposit guarantee and the 100,000 euros: what the amount really covers

The figure almost everyone knows appears on the same BaFin page: the statutory compensation claim for deposits amounts to a maximum of 100,000 euros per customer and per bank, regardless of the number of accounts. With a joint account each holder has a claim of their own, so with two holders the amount doubles to 200,000 euros.

The decisive word is deposits. What is meant is a balance in a currency such as the euro in an account at a CRR credit institution. Bitcoin, ether and the rest of your portfolio are not deposits in this sense, which is why the holdings you keep on a trading platform do not count towards this pot. If you want to know how the price of the largest of these assets is currently moving, our Bitcoin price prediction keeps it continuously updated; for the compensation question, however, the size of the holding makes no difference. It is unprotected either way.

The survey: twelve provider sites, seven evaluable statements

This evaluation was carried out by cryptoticker.io itself on September 8, 2026. The method in one sentence: for twelve providers with a German-language presence we retrieved the publicly reachable security, legal or protection-fund page over HTTP, noted the response code and searched the visible text on it for any mention of compensation, insurance or a protection fund for customer holdings.

Objects examined: twelve provider sites, seventeen pages retrieved in total. The result was evaluable for seven providers. For five it was not, for reasons that have nothing to do with the content of the pages. We set that part out openly further below, because a survey that conceals its gaps is no survey.

What we counted and what we did not

Only what stands on the page itself was counted. A statement in the promotional text of a comparison portal or in an interview does not count here, because it does not bind the provider and cannot be looked up. Nor did we count details of technical security. Cold storage, two-factor sign-in and penetration tests say something about how likely a loss is, and nothing about who bears it if it happens anyway.

Kraken writes it out itself: “No Insurance” in the legal disclosures

The clearest statement in the whole survey comes from Kraken, and it does not sit in the small print of a footnote but as a paragraph of its own in the exchange's Legal Disclosures. It reads: “No Insurance. Digital assets and Kraken accounts are not covered by insurance against losses.” The paragraph then states expressly that the US systems FDIC and SIPC do not apply either, and that there is no comparable protection.

The security page of the same exchange carries the second half of the same thought: for many products and countries the customer may not be protected by state compensation or supervisory systems. One can read that as uncomfortable candour. For the question this article asks, it is the most usable answer in the entire field, because it is unambiguous and can be quoted.

Trust arrangement and cold storage at Bitpanda: segregation is no substitute

On its German security page, Bitpanda describes two things that are frequently confused. First, crypto holdings are said to lie in cold storage, meaning stores without a permanent network connection, whose contents are checked externally at intervals. Second, Bitpanda states that it holds its customers' crypto assets as a trustee on the basis of a legally binding trust agreement; the customer remains the beneficial owner, and there is a legally binding separation between the company's own assets and customer holdings.

This separation is valuable, but it answers a different question. It ensures that your coins do not fall into the estate in an insolvency. Against theft it does not help: what flows out of a separately kept holding is gone just as surely as from a commingled one. The term insurance also appears on the page, though there in connection with Bitpanda Custody, the safekeeping offer for institutional clients. For a private trading account, no promise follows from it.

BISON and the 100,000 euros: the protection applies to the euro balance

On the site of BISON, the trading platform from the Börse Stuttgart group, the familiar figure stands right beside the crypto offering: the euro balance is said to be kept by Solaris SE and at Deutsche Bank, and up to 100,000 euros per investor and bank are protected by German law.

The sentence is correct, and it is meant exactly as narrowly as it stands. What is protected is the euro balance at the partner bank. The crypto-assets displayed on the same interface are not covered by that sentence. Anyone who reads the 100,000 euros in passing and applies it to their entire portfolio has miscalculated on precisely the part at issue here. This mix-up is the most common error we met in this survey. It arises from the proximity of two pieces of information on one screen, not from any incorrect statement by the provider.

Protection fund at Bitget, proof of reserves at OKX: two promises that are not the same

Bitget runs a German-language page on a protection fund of its own and puts it there at $300 million; the page notes that users can file a claim through this fund in the event of a loss. It is the only figure named in the entire survey. A fund of this kind is a voluntary undertaking by the company and not a legal entitlement: how an individual case is decided does not emerge from the page, and it is not a state-supervised compensation system.

OKX takes a different route. The provider's German-language page describes a one-to-one reserve for all holdings in platform accounts and publishes regular reports on it; at the time of retrieval the 46th of these reports was shown, with $22.96 billion in primary holdings. Proof of reserves is the demonstration that a custodian actually holds its customers' assets. It answers the coverage question, not the liability question. How to recompute such a proof yourself, we showed step by step on August 18, 2026 in our guide to proof of reserves.

Crypto.com and the FDIC line: why US deposit insurance is of no use here

The security page of Crypto.com carries a paragraph that is often quoted in comparisons as a protection promise, and that on close reading says the opposite. Fiat balances are said to be held in accounts at regulated custodian banks; for customers resident in the United States, dollar balances are passed on to partner banks that are members of the FDIC. The qualification follows immediately: FDIC protection applies only if the member bank concerned fails, and it protects the funds neither against a failure of Crypto.com nor against the risk of theft or fraud.

For an account in Germany the paragraph is therefore doubly without effect. It concerns persons resident in the US, it concerns fiat balances only, and it expressly excludes the theft case. Anyone who takes such a line as cover for their crypto holdings is reading a promise that is not there.

Naming custodians is not the same as being liable

On its security page, Nexo lists by name the custodians it works with, among them a Munich company licensed as a custodian for digital assets under MiCAR and supervised by BaFin, plus a further custodian for the US business. That is a useful disclosure, because it makes it verifiable who holds the keys. It is not a statement about who replaces a loss, and the page does not claim otherwise.

Five provider pages could not be examined: what this survey does not show

For five of the twelve providers we could evaluate no statement on the survey date. At Bitvavo and Coinbase the servers answered the automated retrieval with code 403 and delivered no page content; in a browser both pages are normally reachable for readers. At Bitstamp and Bybit the server did answer with code 200, but returned virtually no evaluable text, because the content is loaded only later in the browser. A security page at Trade Republic did not exist under the address checked and answered with code 404.

Expressly, nothing follows from this about the security of these providers. All that follows is that we could not capture their promises that day with the same method as those of the other seven. For Bitvavo, German-language comparison portals report a voluntary account guarantee of up to 100,000 euros that is said to include crypto-assets as well. We list this as an unconfirmed indication and not as a finding, because we could not read the statement on a page of the provider itself on September 8.

The result in one line

Of seven evaluable providers, exactly one names a protection fund of its own with a figure. Two point to protective mechanisms that cover a different case from theft, namely separation from own assets and cover for the euro balance at a partner bank. One cites a deposit guarantee that does not apply to German customers. One demonstrates coverage without assuming liability. One names its custodians. And one states in bare words that there is no insurance.

What to check at your own provider in ten minutes

The survey above is a snapshot of seven providers. Yours may not be among them, and terms change. The check can be carried out yourself in a few minutes, though, and it works the same way at every provider.

Open the legal documents, not the security page. The security page is marketing and describes measures; the liability question sits in the terms of use, in the risk warnings or in a document called legal disclosures or risk disclosure. Search there for the words insurance, compensation and liability. If you find none of these terms in connection with your holdings, that is already the answer.

Then check what any figure named actually refers to. If a sum such as 100,000 euros appears on the page, read the sentence before and after it in full and establish whether it speaks of deposits, of euro balances or of crypto-assets. If a bank name appears there, the protection applies to the account at that bank and not to your portfolio. If you are minded to switch provider anyway, a look at our overview of the best regulated crypto exchanges helps, because an authorisation under MiCA brings no compensation with it, but it does bring duties to segregate customer holdings and to report.

The part only you can handle

The most solid protection against a theft at a custodian is to leave no more there than necessary. Holdings you are not trading belong in a wallet whose keys you hold yourself; which devices come into question and how they differ is set out in our hardware wallet comparison. That shifts the risk, it does not remove it: if you lose the key or let it out of your hands, there is all the less any body to compensate you. And if something does go missing, filing a criminal complaint is the first step, as we described on August 21, 2026 in our guide to reporting a crypto theft.

Compensation after crypto theft: what to take away

1. Expect no statutory compensation. On crypto-assets and deposit guarantee, BaFin says “as a rule, no”, and the providers examined do not contradict it. If you want to use a platform at all, choose it deliberately by authorisation and duties, for instance via our overview of the best regulated crypto exchanges.
2. Read the legal documents rather than the security page. Search for insurance, compensation and liability, and check for every figure named whether it applies to the euro balance or to the coins. If comparing several providers interests you, the terms are gathered under best crypto exchanges.
3. Move what you are not trading into your own custody. What is not held at a third party cannot flow out there either. Suitable devices and their differences are set out in the hardware wallet comparison; responsibility for the key then rests entirely with you.

(As of September 8, 2026. This article is not investment advice. Prices and fee structures change; check the terms with the provider before you buy.)